diff --git a/data/2024/CVE-2024-4079.json b/data/2024/CVE-2024-4079.json
index 06cdc3a217..08fd3d07dc 100644
--- a/data/2024/CVE-2024-4079.json
+++ b/data/2024/CVE-2024-4079.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"LabVIEW","vendor":"NI","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"labview","vendor":"ni","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*","matchCriteriaId":"E9BBCA76-7B4C-4CC5-A782-489CA4223C04","versionEndIncluding":"2020","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2021:-:*:*:*:*:*:*","matchCriteriaId":"9F184512-5D11-47F4-8555-EA6FF93C106F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2021:sp1:*:*:*:*:*:*","matchCriteriaId":"BF28259A-30A6-4BB1-B262-A006AB74AFFA","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*","matchCriteriaId":"4D12D6CF-802F-47BA-ADF9-9E52C071BD7F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*","matchCriteriaId":"340F61E5-D1ED-4C29-A894-8BC5C5B90ACE","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*","matchCriteriaId":"D7DD2022-CFB7-4F38-B459-C1AFB55B5B68","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*","matchCriteriaId":"18AB0B07-72FE-4861-B69D-AD2E87C5382E","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*","matchCriteriaId":"044C4B51-C641-41F2-ACA0-834C99D63285","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*","matchCriteriaId":"7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions."},{"lang":"es","value":"Una lectura fuera de los límites debido a una verificación de límites faltantes en LabVIEW puede revelar información o resultar en la ejecución de código arbitrario. La explotación exitosa requiere que un atacante proporcione al usuario un VI especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."}],"id":"CVE-2024-4079","lastModified":"2026-06-17T08:01:04.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:10:10.492631Z","version":"2.0.3"}}]},"published":"2024-07-23T14:15:14.353","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"LabVIEW","vendor":"NI","versions":[{"lessThan":"24.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"labview","vendor":"ni","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*","matchCriteriaId":"E9BBCA76-7B4C-4CC5-A782-489CA4223C04","versionEndIncluding":"2020","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2021:-:*:*:*:*:*:*","matchCriteriaId":"9F184512-5D11-47F4-8555-EA6FF93C106F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2021:sp1:*:*:*:*:*:*","matchCriteriaId":"BF28259A-30A6-4BB1-B262-A006AB74AFFA","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*","matchCriteriaId":"4D12D6CF-802F-47BA-ADF9-9E52C071BD7F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*","matchCriteriaId":"340F61E5-D1ED-4C29-A894-8BC5C5B90ACE","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*","matchCriteriaId":"D7DD2022-CFB7-4F38-B459-C1AFB55B5B68","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*","matchCriteriaId":"18AB0B07-72FE-4861-B69D-AD2E87C5382E","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*","matchCriteriaId":"044C4B51-C641-41F2-ACA0-834C99D63285","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*","matchCriteriaId":"7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions."},{"lang":"es","value":"Una lectura fuera de los límites debido a una verificación de límites faltantes en LabVIEW puede revelar información o resultar en la ejecución de código arbitrario. La explotación exitosa requiere que un atacante proporcione al usuario un VI especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."}],"id":"CVE-2024-4079","lastModified":"2026-11-11T21:16:40.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:10:10.492631Z","version":"2.0.3"}}]},"published":"2024-07-23T14:15:14.353","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-due-to-missing-bounds-check-in-labview.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-4080.json b/data/2024/CVE-2024-4080.json
index 821244770f..c471055f0a 100644
--- a/data/2024/CVE-2024-4080.json
+++ b/data/2024/CVE-2024-4080.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"LabVIEW","vendor":"NI","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"labview","vendor":"ni","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*","matchCriteriaId":"E9BBCA76-7B4C-4CC5-A782-489CA4223C04","versionEndIncluding":"2020","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2021:-:*:*:*:*:*:*","matchCriteriaId":"9F184512-5D11-47F4-8555-EA6FF93C106F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2021:sp1:*:*:*:*:*:*","matchCriteriaId":"BF28259A-30A6-4BB1-B262-A006AB74AFFA","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*","matchCriteriaId":"4D12D6CF-802F-47BA-ADF9-9E52C071BD7F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*","matchCriteriaId":"340F61E5-D1ED-4C29-A894-8BC5C5B90ACE","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*","matchCriteriaId":"D7DD2022-CFB7-4F38-B459-C1AFB55B5B68","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*","matchCriteriaId":"18AB0B07-72FE-4861-B69D-AD2E87C5382E","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*","matchCriteriaId":"044C4B51-C641-41F2-ACA0-834C99D63285","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*","matchCriteriaId":"7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions."},{"lang":"es","value":" Un problema de corrupción de memoria debido a una verificación de longitud incorrecta en LabVIEW tdcore.dll puede revelar información o resultar en la ejecución de código arbitrario. La explotación exitosa requiere que un atacante proporcione al usuario un VI especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."}],"id":"CVE-2024-4080","lastModified":"2026-06-17T08:01:04.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ni.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4080","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-24T15:08:22.993606Z","version":"2.0.3"}}]},"published":"2024-07-23T14:15:14.590","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"LabVIEW","vendor":"NI","versions":[{"lessThan":"24.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"labview","vendor":"ni","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*","matchCriteriaId":"E9BBCA76-7B4C-4CC5-A782-489CA4223C04","versionEndIncluding":"2020","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2021:-:*:*:*:*:*:*","matchCriteriaId":"9F184512-5D11-47F4-8555-EA6FF93C106F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2021:sp1:*:*:*:*:*:*","matchCriteriaId":"BF28259A-30A6-4BB1-B262-A006AB74AFFA","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*","matchCriteriaId":"4D12D6CF-802F-47BA-ADF9-9E52C071BD7F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*","matchCriteriaId":"340F61E5-D1ED-4C29-A894-8BC5C5B90ACE","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*","matchCriteriaId":"D7DD2022-CFB7-4F38-B459-C1AFB55B5B68","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*","matchCriteriaId":"18AB0B07-72FE-4861-B69D-AD2E87C5382E","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*","matchCriteriaId":"044C4B51-C641-41F2-ACA0-834C99D63285","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*","matchCriteriaId":"7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution.  Successful exploitation requires an attacker to provide a user with a specially crafted VI.  This vulnerability affects LabVIEW 2024 Q1 and prior versions."},{"lang":"es","value":" Un problema de corrupción de memoria debido a una verificación de longitud incorrecta en LabVIEW tdcore.dll puede revelar información o resultar en la ejecución de código arbitrario. La explotación exitosa requiere que un atacante proporcione al usuario un VI especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."}],"id":"CVE-2024-4080","lastModified":"2026-11-11T21:16:40.383","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@ni.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4080","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-24T15:08:22.993606Z","version":"2.0.3"}}]},"published":"2024-07-23T14:15:14.590","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-issues-due-to-improper-length-checks-in-labview.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-6121.json b/data/2024/CVE-2024-6121.json
index a4c922853c..3d5805467a 100644
--- a/data/2024/CVE-2024-6121.json
+++ b/data/2024/CVE-2024-6121.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"SystemLink Server","vendor":"NI","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["Windows"],"product":"FlexLogger","vendor":"NI","versions":[{"lessThanOrEqual":"23.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*","matchCriteriaId":"8D4CB33D-BB7C-4EBD-9E78-A9EDF952A7A6","versionEndIncluding":"2023","vulnerable":true},{"criteria":"cpe:2.3:a:ni:flexlogger:2023:q2:*:*:*:*:*:*","matchCriteriaId":"FA33AE39-F976-4C56-9A4B-8932BC6855C9","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*","matchCriteriaId":"61E2B822-C1E9-4ED5-A6D1-FF569A414330","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:systemlink:2024:q1:*:*:*:*:*:*","matchCriteriaId":"FA70DCDA-FE97-42A2-B45E-33154D29B840","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834.  This affects NI SystemLink Server 2024 Q1 and prior versions.  It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."},{"lang":"es","value":" Una versión desactualizada de Redis enviada con NI SystemLink Server es susceptible a múltiples vulnerabilidades, incluida CVE-2022-24834. Esto afecta a NI SystemLink Server 2024 Q1 y versiones anteriores. También afecta a NI FlexLogger 2023 Q2 y versiones anteriores que instalaron este servicio compartido."}],"id":"CVE-2024-6121","lastModified":"2026-06-17T08:17:20.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6121","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-29T16:55:03.521839Z","version":"2.0.3"}}]},"published":"2024-07-22T20:15:04.267","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"SystemLink Server","vendor":"NI","versions":[{"lessThanOrEqual":"24.1.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["Windows"],"product":"FlexLogger","vendor":"NI","versions":[{"lessThanOrEqual":"23.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*","matchCriteriaId":"8D4CB33D-BB7C-4EBD-9E78-A9EDF952A7A6","versionEndIncluding":"2023","vulnerable":true},{"criteria":"cpe:2.3:a:ni:flexlogger:2023:q2:*:*:*:*:*:*","matchCriteriaId":"FA33AE39-F976-4C56-9A4B-8932BC6855C9","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*","matchCriteriaId":"61E2B822-C1E9-4ED5-A6D1-FF569A414330","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:systemlink:2024:q1:*:*:*:*:*:*","matchCriteriaId":"FA70DCDA-FE97-42A2-B45E-33154D29B840","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834.  This affects NI SystemLink Server 2024 Q1 and prior versions.  It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."},{"lang":"es","value":" Una versión desactualizada de Redis enviada con NI SystemLink Server es susceptible a múltiples vulnerabilidades, incluida CVE-2022-24834. Esto afecta a NI SystemLink Server 2024 Q1 y versiones anteriores. También afecta a NI FlexLogger 2023 Q2 y versiones anteriores que instalaron este servicio compartido."}],"id":"CVE-2024-6121","lastModified":"2026-11-11T21:16:40.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6121","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-29T16:55:03.521839Z","version":"2.0.3"}}]},"published":"2024-07-22T20:15:04.267","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-6122.json b/data/2024/CVE-2024-6122.json
index 386313b6f5..8bb7476604 100644
--- a/data/2024/CVE-2024-6122.json
+++ b/data/2024/CVE-2024-6122.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"SystemLink Server","vendor":"NI","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["Windows"],"product":"FlexLogger","vendor":"NI","versions":[{"lessThanOrEqual":"23.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"systemlink","vendor":"ni","versions":[{"lessThanOrEqual":"2024q1","status":"affected","version":"0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"flexlogger","vendor":"ni","versions":[{"lessThanOrEqual":"2023q2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*","matchCriteriaId":"61E2B822-C1E9-4ED5-A6D1-FF569A414330","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:systemlink:2024:q1:*:*:*:*:*:*","matchCriteriaId":"FA70DCDA-FE97-42A2-B45E-33154D29B840","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*","matchCriteriaId":"8D4CB33D-BB7C-4EBD-9E78-A9EDF952A7A6","versionEndIncluding":"2023","vulnerable":true},{"criteria":"cpe:2.3:a:ni:flexlogger:2023:q2:*:*:*:*:*:*","matchCriteriaId":"FA33AE39-F976-4C56-9A4B-8932BC6855C9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access.  This affects NI SystemLink Server 2024 Q1 and prior versions.  It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."},{"lang":"es","value":" Un permiso incorrecto en el directorio de instalación para el servicio compartido NI SystemLink Server KeyValueDatabase puede resultar en la divulgación de información a través del acceso local. Esto afecta a NI SystemLink Server 2024 Q1 y versiones anteriores. También afecta a NI FlexLogger 2023 Q2 y versiones anteriores que instalaron este servicio compartido."}],"id":"CVE-2024-6122","lastModified":"2026-06-17T08:17:20.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6122","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:14:23.092610Z","version":"2.0.3"}}]},"published":"2024-07-22T20:15:04.470","references":[{"source":"security@ni.com","tags":["Mitigation","Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-276"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"SystemLink Server","vendor":"NI","versions":[{"lessThanOrEqual":"24.1.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["Windows"],"product":"FlexLogger","vendor":"NI","versions":[{"lessThanOrEqual":"23.2.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"systemlink","vendor":"ni","versions":[{"lessThanOrEqual":"2024q1","status":"affected","version":"0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"flexlogger","vendor":"ni","versions":[{"lessThanOrEqual":"2023q2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*","matchCriteriaId":"61E2B822-C1E9-4ED5-A6D1-FF569A414330","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:systemlink:2024:q1:*:*:*:*:*:*","matchCriteriaId":"FA70DCDA-FE97-42A2-B45E-33154D29B840","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:flexlogger:*:*:*:*:*:*:*:*","matchCriteriaId":"8D4CB33D-BB7C-4EBD-9E78-A9EDF952A7A6","versionEndIncluding":"2023","vulnerable":true},{"criteria":"cpe:2.3:a:ni:flexlogger:2023:q2:*:*:*:*:*:*","matchCriteriaId":"FA33AE39-F976-4C56-9A4B-8932BC6855C9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access.  This affects NI SystemLink Server 2024 Q1 and prior versions.  It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service."},{"lang":"es","value":" Un permiso incorrecto en el directorio de instalación para el servicio compartido NI SystemLink Server KeyValueDatabase puede resultar en la divulgación de información a través del acceso local. Esto afecta a NI SystemLink Server 2024 Q1 y versiones anteriores. También afecta a NI FlexLogger 2023 Q2 y versiones anteriores que instalaron este servicio compartido."}],"id":"CVE-2024-6122","lastModified":"2026-11-11T21:16:40.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6122","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:14:23.092610Z","version":"2.0.3"}}]},"published":"2024-07-22T20:15:04.470","references":[{"source":"security@ni.com","tags":["Mitigation","Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-default-directory-permissions-for-ni-systemlink-redis-service.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-276"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-6638.json b/data/2024/CVE-2024-6638.json
index 2710dda1eb..827fb02602 100644
--- a/data/2024/CVE-2024-6638.json
+++ b/data/2024/CVE-2024-6638.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"LabVIEW","vendor":"NI","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"labview","vendor":"ni","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*","matchCriteriaId":"807AE6D5-8096-47A2-A47D-1A5EFC85652D","versionEndIncluding":"2021","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*","matchCriteriaId":"4D12D6CF-802F-47BA-ADF9-9E52C071BD7F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*","matchCriteriaId":"340F61E5-D1ED-4C29-A894-8BC5C5B90ACE","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3_patch1:*:*:*:*:*:*","matchCriteriaId":"52CC3023-4913-40BA-B74C-786F32DC7551","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3_patch2:*:*:*:*:*:*","matchCriteriaId":"FC150E98-5889-4A65-84B8-E4871091D104","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*","matchCriteriaId":"D7DD2022-CFB7-4F38-B459-C1AFB55B5B68","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*","matchCriteriaId":"18AB0B07-72FE-4861-B69D-AD2E87C5382E","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch1:*:*:*:*:*:*","matchCriteriaId":"91928C9C-F094-4EE4-9FBE-2B7956D68E6F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*","matchCriteriaId":"044C4B51-C641-41F2-ACA0-834C99D63285","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch3:*:*:*:*:*:*","matchCriteriaId":"26EEE5E3-AD37-4832-A66C-5F8F7A478F30","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch4:*:*:*:*:*:*","matchCriteriaId":"5DC20B17-C582-42C4-9780-5DC61B4AED91","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*","matchCriteriaId":"7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2024:q1_patch1:*:*:*:*:*:*","matchCriteriaId":"953E8FD0-4420-4592-B696-C377D4EE0CA2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop.  Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file.  This vulnerability affects LabVIEW 2024 Q1 and prior versions."},{"lang":"es","value":"Una vulnerabilidad de desbordamiento de enteros debido a una validación de entrada incorrecta al leer archivos TDMS en LabVIEW puede resultar en un bucle infinito. La explotación exitosa requiere que un atacante proporcione al usuario un archivo TDMS especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."}],"id":"CVE-2024-6638","lastModified":"2026-06-17T08:18:23.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6638","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:13:58.614582Z","version":"2.0.3"}}]},"published":"2024-07-22T20:15:04.723","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"LabVIEW","vendor":"NI","versions":[{"lessThanOrEqual":"24.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"labview","vendor":"ni","versions":[{"lessThanOrEqual":"24.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*","matchCriteriaId":"807AE6D5-8096-47A2-A47D-1A5EFC85652D","versionEndIncluding":"2021","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:*","matchCriteriaId":"4D12D6CF-802F-47BA-ADF9-9E52C071BD7F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:*","matchCriteriaId":"340F61E5-D1ED-4C29-A894-8BC5C5B90ACE","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3_patch1:*:*:*:*:*:*","matchCriteriaId":"52CC3023-4913-40BA-B74C-786F32DC7551","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2022:q3_patch2:*:*:*:*:*:*","matchCriteriaId":"FC150E98-5889-4A65-84B8-E4871091D104","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:*","matchCriteriaId":"D7DD2022-CFB7-4F38-B459-C1AFB55B5B68","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:*","matchCriteriaId":"18AB0B07-72FE-4861-B69D-AD2E87C5382E","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch1:*:*:*:*:*:*","matchCriteriaId":"91928C9C-F094-4EE4-9FBE-2B7956D68E6F","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:*","matchCriteriaId":"044C4B51-C641-41F2-ACA0-834C99D63285","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch3:*:*:*:*:*:*","matchCriteriaId":"26EEE5E3-AD37-4832-A66C-5F8F7A478F30","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2023:q3_patch4:*:*:*:*:*:*","matchCriteriaId":"5DC20B17-C582-42C4-9780-5DC61B4AED91","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:*","matchCriteriaId":"7753CCDF-BAF8-4F91-B85B-EBB2B88F6F30","vulnerable":true},{"criteria":"cpe:2.3:a:ni:labview:2024:q1_patch1:*:*:*:*:*:*","matchCriteriaId":"953E8FD0-4420-4592-B696-C377D4EE0CA2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop.  Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file.  This vulnerability affects LabVIEW 2024 Q1 and prior versions."},{"lang":"es","value":"Una vulnerabilidad de desbordamiento de enteros debido a una validación de entrada incorrecta al leer archivos TDMS en LabVIEW puede resultar en un bucle infinito. La explotación exitosa requiere que un atacante proporcione al usuario un archivo TDMS especialmente manipulado. Esta vulnerabilidad afecta a LabVIEW 2024 Q1 y versiones anteriores."}],"id":"CVE-2024-6638","lastModified":"2026-11-11T21:16:40.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6638","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:13:58.614582Z","version":"2.0.3"}}]},"published":"2024-07-22T20:15:04.723","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/integer-overflow-vulnerability-reading-tdms-files-in-labview.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-6675.json b/data/2024/CVE-2024-6675.json
index 39d7531d5e..7f97aa7c38 100644
--- a/data/2024/CVE-2024-6675.json
+++ b/data/2024/CVE-2024-6675.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted project file.  This vulnerability affects VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":" Existe una vulnerabilidad de deserialización de datos no confiables en NI VeriStand que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante consiga que un usuario abra un archivo de proyecto especialmente manipulado. Esta vulnerabilidad afecta a VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6675","lastModified":"2026-06-17T08:18:27.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6675","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:17:56.552343Z","version":"2.0.3"}}]},"published":"2024-07-22T20:15:04.940","references":[{"source":"security@ni.com","url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-veristand-project-file.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-veristand-project-file.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@ni.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThan":"24.5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted project file.  This vulnerability affects VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":" Existe una vulnerabilidad de deserialización de datos no confiables en NI VeriStand que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante consiga que un usuario abra un archivo de proyecto especialmente manipulado. Esta vulnerabilidad afecta a VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6675","lastModified":"2026-11-11T21:16:41.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6675","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:17:56.552343Z","version":"2.0.3"}}]},"published":"2024-07-22T20:15:04.940","references":[{"source":"security@ni.com","url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-veristand-project-file.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerability-in-ni-veristand-project-file.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@ni.com","type":"Secondary"}]}
diff --git a/data/2024/CVE-2024-6791.json b/data/2024/CVE-2024-6791.json
index c8b562804b..d7cc369b19 100644
--- a/data/2024/CVE-2024-6791.json
+++ b/data/2024/CVE-2024-6791.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file.  This vulnerability affects VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":"Existe una vulnerabilidad de path traversal de directorio al cargar un archivo vsmodel en NI VeriStand que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante consiga que un usuario abra un archivo .vsmodel especialmente manipulado. Esta vulnerabilidad afecta a VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6791","lastModified":"2026-06-17T08:18:43.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T13:19:27.399065Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:04.360","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThan":"24.5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file.  This vulnerability affects VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":"Existe una vulnerabilidad de path traversal de directorio al cargar un archivo vsmodel en NI VeriStand que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante consiga que un usuario abra un archivo .vsmodel especialmente manipulado. Esta vulnerabilidad afecta a VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6791","lastModified":"2026-11-11T21:16:41.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T13:19:27.399065Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:04.360","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-6793.json b/data/2024/CVE-2024-6793.json
index 0290824946..163a009008 100644
--- a/data/2024/CVE-2024-6793.json
+++ b/data/2024/CVE-2024-6793.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization of untrusted data vulnerability exists in NI VeriStand  DataLogging Server that may result in remote code execution.  Successful exploitation requires an attacker to send a specially crafted message.  These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":" Existe una vulnerabilidad de deserialización de datos no confiables en NI VeriStand DataLogging Server que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante envíe un mensaje especialmente manipulado. Estas vulnerabilidades afectan a NI VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6793","lastModified":"2026-06-17T08:18:43.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6793","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:29:53.018684Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:04.547","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThan":"24.5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization of untrusted data vulnerability exists in NI VeriStand  DataLogging Server that may result in remote code execution.  Successful exploitation requires an attacker to send a specially crafted message.  These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":" Existe una vulnerabilidad de deserialización de datos no confiables en NI VeriStand DataLogging Server que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante envíe un mensaje especialmente manipulado. Estas vulnerabilidades afectan a NI VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6793","lastModified":"2026-11-11T21:16:41.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6793","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:29:53.018684Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:04.547","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-6794.json b/data/2024/CVE-2024-6794.json
index c97ee00a33..a7245a5e85 100644
--- a/data/2024/CVE-2024-6794.json
+++ b/data/2024/CVE-2024-6794.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming  Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":" Existe una vulnerabilidad de deserialización de datos no confiables en NI VeriStand Waveform Streaming Server que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante envíe un mensaje especialmente manipulado. Estas vulnerabilidades afectan a NI VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6794","lastModified":"2026-06-17T08:18:43.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6794","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-24T15:42:22.258155Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:04.733","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThan":"24.5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming  Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":" Existe una vulnerabilidad de deserialización de datos no confiables en NI VeriStand Waveform Streaming Server que puede resultar en la ejecución remota de código. La explotación exitosa requiere que un atacante envíe un mensaje especialmente manipulado. Estas vulnerabilidades afectan a NI VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6794","lastModified":"2026-11-11T21:16:41.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6794","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-24T15:42:22.258155Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:04.733","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-6805.json b/data/2024/CVE-2024-6805.json
index e7791df6ee..86ee6eb366 100644
--- a/data/2024/CVE-2024-6805.json
+++ b/data/2024/CVE-2024-6805.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources.  These missing checks may result in information disclosure or remote code execution.  This affects NI VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":"A NI VeriStand Gateway le faltan verificaciones de autorización cuando un actor intenta acceder a los recursos de transferencia de archivos. Estas comprobaciones faltantes pueden resultar en la divulgación de información o la ejecución remota de código. Esto afecta a NI VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6805","lastModified":"2026-06-17T08:18:45.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T20:44:15.876909Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:04.940","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-862"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThan":"24.5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources.  These missing checks may result in information disclosure or remote code execution.  This affects NI VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":"A NI VeriStand Gateway le faltan verificaciones de autorización cuando un actor intenta acceder a los recursos de transferencia de archivos. Estas comprobaciones faltantes pueden resultar en la divulgación de información o la ejecución remota de código. Esto afecta a NI VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6805","lastModified":"2026-11-11T21:16:41.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T20:44:15.876909Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:04.940","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-862"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2024/CVE-2024-6806.json b/data/2024/CVE-2024-6806.json
index a6225112f2..0d43751faa 100644
--- a/data/2024/CVE-2024-6806.json
+++ b/data/2024/CVE-2024-6806.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources.  These missing checks may result in remote code execution.  This affects NI VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":" A NI VeriStand Gateway le faltan verificaciones de autorización cuando un actor intenta acceder a los recursos del Proyecto. Estas comprobaciones faltantes pueden provocar la ejecución remota de código. Esto afecta a NI VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6806","lastModified":"2026-06-17T08:18:45.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6806","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:31:31.475688Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:05.133","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-862"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"VeriStand","vendor":"NI","versions":[{"lessThan":"24.5.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@ni.com"},{"affectedData":[{"cpes":["cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"veristand","vendor":"ni","versions":[{"lessThanOrEqual":"24.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ni:veristand:*:*:*:*:*:*:*:*","matchCriteriaId":"3D02E16D-4488-493C-BA90-F73B13926EF7","versionEndIncluding":"2024","vulnerable":true},{"criteria":"cpe:2.3:a:ni:veristand:2024:q2:*:*:*:*:*:*","matchCriteriaId":"E70C6E0E-8FEE-4B59-8D7D-152384D7C3F1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources.  These missing checks may result in remote code execution.  This affects NI VeriStand 2024 Q2 and prior versions."},{"lang":"es","value":" A NI VeriStand Gateway le faltan verificaciones de autorización cuando un actor intenta acceder a los recursos del Proyecto. Estas comprobaciones faltantes pueden provocar la ejecución remota de código. Esto afecta a NI VeriStand 2024 Q2 y versiones anteriores."}],"id":"CVE-2024-6806","lastModified":"2026-11-11T21:16:41.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@ni.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-6806","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-07-23T14:31:31.475688Z","version":"2.0.3"}}]},"published":"2024-07-22T21:15:05.133","references":[{"source":"security@ni.com","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html"}],"sourceIdentifier":"security@ni.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@ni.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-862"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-100307.json b/data/2026/CVE-2026-100307.json
new file mode 100644
index 0000000000..ca7ae68b33
--- /dev/null
+++ b/data/2026/CVE-2026-100307.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mcp-gateway-registry","vendor":"AWS","versions":[{"lessThanOrEqual":"1.24.7","status":"affected","version":"1.0.9","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every registered gateway asset via a crafted group import request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.25.0."}],"id":"CVE-2026-100307","lastModified":"2026-11-11T21:16:41.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-11T21:16:41.933","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-179-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.25.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-rxf3-qgpv-wxvr"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-862"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-103038.json b/data/2026/CVE-2026-103038.json
index 23b8975631..578ae5ad95 100644
--- a/data/2026/CVE-2026-103038.json
+++ b/data/2026/CVE-2026-103038.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:*:*:*:android:*:*"],"defaultStatus":"unaffected","platforms":["Android"],"product":"PingTools Network Utilities","vendor":"StreamSoft","versions":[{"status":"affected","version":"4.64"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions."}],"id":"CVE-2026-103038","lastModified":"2026-10-20T20:17:11.820","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-20T19:29:21.457795Z","version":"2.0.3"}}]},"published":"2026-10-19T17:17:00.400","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory"},{"source":"help@fluidattacks.com","url":"https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"help@fluidattacks.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:streamsoft:pingtools_network_utilities:4.64:*:*:*:*:android:*:*"],"defaultStatus":"unaffected","platforms":["Android"],"product":"PingTools Network Utilities","vendor":"StreamSoft","versions":[{"status":"affected","version":"4.64","versionType":"custom"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions."}],"id":"CVE-2026-103038","lastModified":"2026-11-11T22:17:10.650","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103038","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-20T19:29:21.457795Z","version":"2.0.3"}}]},"published":"2026-10-19T17:17:00.400","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/yanderechainsawregurgitationfactory"},{"source":"help@fluidattacks.com","url":"https://play.google.com/store/apps/details?id=ua.com.streamsoft.pingtools"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"help@fluidattacks.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-103980.json b/data/2026/CVE-2026-103980.json
new file mode 100644
index 0000000000..ad185aa18b
--- /dev/null
+++ b/data/2026/CVE-2026-103980.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"ideon","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6."}],"id":"CVE-2026-103980","lastModified":"2026-11-11T21:16:42.083","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:42.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-111521.json b/data/2026/CVE-2026-111521.json
new file mode 100644
index 0000000000..1ae805b1a2
--- /dev/null
+++ b/data/2026/CVE-2026-111521.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Display and Peripheral Manager (DDPM Windows)","vendor":"Dell","versions":[{"lessThan":"2.4.0.17","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution."}],"id":"CVE-2026-111521","lastModified":"2026-11-11T22:17:10.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T22:17:10.820","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527625/dsa-2026-482-security-update-for-dell-display-and-peripheral-manager-ddpm-windows-for-a-time-of-check-time-of-use-toctou-vulnerability"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-121526.json b/data/2026/CVE-2026-121526.json
new file mode 100644
index 0000000000..110b85669e
--- /dev/null
+++ b/data/2026/CVE-2026-121526.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.5.7","status":"affected","version":"6.5.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests."}],"id":"CVE-2026-121526","lastModified":"2026-11-11T22:17:10.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:10.970","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-191"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-121527.json b/data/2026/CVE-2026-121527.json
new file mode 100644
index 0000000000..6dfb43282c
--- /dev/null
+++ b/data/2026/CVE-2026-121527.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:forticlientems:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiClientEMS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.3","versionType":"semver"},{"lessThanOrEqual":"7.4.1","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.15","status":"affected","version":"7.2.12","versionType":"semver"},{"lessThanOrEqual":"7.2.10","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands."}],"id":"CVE-2026-121527","lastModified":"2026-11-11T22:17:11.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.113","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-192"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-250"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-121528.json b/data/2026/CVE-2026-121528.json
new file mode 100644
index 0000000000..290fc02b40
--- /dev/null
+++ b/data/2026/CVE-2026-121528.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.9","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"6.4.16","status":"affected","version":"6.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website."}],"id":"CVE-2026-121528","lastModified":"2026-11-11T22:17:11.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.250","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-193"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-122056.json b/data/2026/CVE-2026-122056.json
index a7c07bee06..af175eeceb 100644
--- a/data/2026/CVE-2026-122056.json
+++ b/data/2026/CVE-2026-122056.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"openscap","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS)."}],"id":"CVE-2026-122056","lastModified":"2026-11-09T22:18:34.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-09T22:18:34.163","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-122056"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567100"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"openscap","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS)."}],"id":"CVE-2026-122056","lastModified":"2026-11-11T21:16:42.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T22:18:34.163","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-122056"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567100"},{"source":"secalert@redhat.com","url":"https://github.com/OpenSCAP/openscap/security/advisories/GHSA-5h6x-q65w-wxvf"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125926.json b/data/2026/CVE-2026-125926.json
new file mode 100644
index 0000000000..a2879076d9
--- /dev/null
+++ b/data/2026/CVE-2026-125926.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mcp-gateway-registry","vendor":"AWS","versions":[{"lessThanOrEqual":"1.34.0","status":"affected","version":"1.0.3","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.35.0."}],"id":"CVE-2026-125926","lastModified":"2026-11-11T21:16:42.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-11T21:16:42.867","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126144.json b/data/2026/CVE-2026-126144.json
new file mode 100644
index 0000000000..ef7c5a6850
--- /dev/null
+++ b/data/2026/CVE-2026-126144.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortivoice:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiVoice","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.4.2","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.5","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.8","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2 all versions, FortiRecorder 7.6.0 through 7.6.2, FortiRecorder 7.2.0 through 7.2.12, FortiRecorder 7.0.0 through 7.0.6, FortiVoice 8.0.0 through 8.0.1, FortiVoice 7.4.0 through 7.4.2, FortiVoice 7.2.0 through 7.2.5, FortiVoice 7.0.0 through 7.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}],"id":"CVE-2026-126144","lastModified":"2026-11-11T22:17:11.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.400","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-196"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126145.json b/data/2026/CVE-2026-126145.json
new file mode 100644
index 0000000000..caed25803a
--- /dev/null
+++ b/data/2026/CVE-2026-126145.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated administrator with system-time read-write access to execute unauthorized code or commands as root."}],"id":"CVE-2026-126145","lastModified":"2026-11-11T22:17:11.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.580","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-197"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126146.json b/data/2026/CVE-2026-126146.json
new file mode 100644
index 0000000000..404112fb41
--- /dev/null
+++ b/data/2026/CVE-2026-126146.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortirecorder:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortirecorder:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiRecorder","vendor":"Fortinet","versions":[{"status":"affected","version":"7.6.0"},{"lessThanOrEqual":"7.2.11","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.6","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6, FortiMail 7.2.0 through 7.2.9, FortiRecorder 7.6.0, FortiRecorder 7.2.0 through 7.2.11, FortiRecorder 7.0.0 through 7.0.6 may allow an authenticated privileged attacker to execute unauthorized code or commands via a specifically crafted archive account configuration."}],"id":"CVE-2026-126146","lastModified":"2026-11-11T22:17:11.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-198"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126147.json b/data/2026/CVE-2026-126147.json
new file mode 100644
index 0000000000..6dec2d82b9
--- /dev/null
+++ b/data/2026/CVE-2026-126147.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126147","lastModified":"2026-11-11T22:17:11.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:11.880","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-199"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126148.json b/data/2026/CVE-2026-126148.json
new file mode 100644
index 0000000000..56169a6241
--- /dev/null
+++ b/data/2026/CVE-2026-126148.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HA join-request packets."}],"id":"CVE-2026-126148","lastModified":"2026-11-11T22:17:12.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.010","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-200"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126149.json b/data/2026/CVE-2026-126149.json
new file mode 100644
index 0000000000..1d7e9cfa54
--- /dev/null
+++ b/data/2026/CVE-2026-126149.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to crash the daemon."}],"id":"CVE-2026-126149","lastModified":"2026-11-11T22:17:12.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.137","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-201"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126150.json b/data/2026/CVE-2026-126150.json
new file mode 100644
index 0000000000..2755cc8936
--- /dev/null
+++ b/data/2026/CVE-2026-126150.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.5","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.7","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to reset the password of an arbitrary IBE webmail user and take over their account via specially crafted HTTP requests."}],"id":"CVE-2026-126150","lastModified":"2026-11-11T22:17:12.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.543","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-202"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126151.json b/data/2026/CVE-2026-126151.json
new file mode 100644
index 0000000000..7b5fb38978
--- /dev/null
+++ b/data/2026/CVE-2026-126151.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to gain elevation of privilege (account takeover) via a crafted request."}],"id":"CVE-2026-126151","lastModified":"2026-11-11T22:17:12.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.720","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-203"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126152.json b/data/2026/CVE-2026-126152.json
new file mode 100644
index 0000000000..e014971d4a
--- /dev/null
+++ b/data/2026/CVE-2026-126152.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker to delete arbitrary directories as root, or to access or delete other users' calendar and mailbox data across tenant domains, via crafted HTTP requests to the webmail and administrative interfaces."}],"id":"CVE-2026-126152","lastModified":"2026-11-11T22:17:12.877","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:12.877","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-204"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126153.json b/data/2026/CVE-2026-126153.json
new file mode 100644
index 0000000000..56e50194f7
--- /dev/null
+++ b/data/2026/CVE-2026-126153.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized commands via crafted requests."}],"id":"CVE-2026-126153","lastModified":"2026-11-11T22:17:13.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.050","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-205"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126154.json b/data/2026/CVE-2026-126154.json
new file mode 100644
index 0000000000..b0020a0c79
--- /dev/null
+++ b/data/2026/CVE-2026-126154.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted HTTP request."}],"id":"CVE-2026-126154","lastModified":"2026-11-11T22:17:13.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.190","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-206"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126155.json b/data/2026/CVE-2026-126155.json
new file mode 100644
index 0000000000..5b61e308e2
--- /dev/null
+++ b/data/2026/CVE-2026-126155.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to obtain an authenticated IBE webmail session as any IBE recipient and read or send their encrypted mail via crafted HTTP requests."}],"id":"CVE-2026-126155","lastModified":"2026-11-11T22:17:13.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.323","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-207"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126156.json b/data/2026/CVE-2026-126156.json
new file mode 100644
index 0000000000..17dadf7d95
--- /dev/null
+++ b/data/2026/CVE-2026-126156.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated remote attacker to take over an arbitrary IBE recipient account via crafted HTTP requests."}],"id":"CVE-2026-126156","lastModified":"2026-11-11T22:17:13.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.450","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-208"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126157.json b/data/2026/CVE-2026-126157.json
new file mode 100644
index 0000000000..bf82dbc826
--- /dev/null
+++ b/data/2026/CVE-2026-126157.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to gain access to other users' secure email accounts via crafted HTTP requests."}],"id":"CVE-2026-126157","lastModified":"2026-11-11T22:17:13.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.587","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-209"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126158.json b/data/2026/CVE-2026-126158.json
new file mode 100644
index 0000000000..cef9a7de20
--- /dev/null
+++ b/data/2026/CVE-2026-126158.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow an authenticated administrator to execute unauthorized code or commands as root via specially crafted HTTP requests."}],"id":"CVE-2026-126158","lastModified":"2026-11-11T22:17:13.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.723","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-210"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126159.json b/data/2026/CVE-2026-126159.json
new file mode 100644
index 0000000000..f035061251
--- /dev/null
+++ b/data/2026/CVE-2026-126159.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release request."}],"id":"CVE-2026-126159","lastModified":"2026-11-11T22:17:13.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.857","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-211"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126160.json b/data/2026/CVE-2026-126160.json
new file mode 100644
index 0000000000..3a8c7d4527
--- /dev/null
+++ b/data/2026/CVE-2026-126160.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to escalate privileges and release or delete quarantined messages for arbitrary mailboxes via a crafted quarantine release requests."}],"id":"CVE-2026-126160","lastModified":"2026-11-11T22:17:13.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:13.990","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-212"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126161.json b/data/2026/CVE-2026-126161.json
new file mode 100644
index 0000000000..af453996dc
--- /dev/null
+++ b/data/2026/CVE-2026-126161.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.6 may allow a remote unauthenticated attacker to cause a denial of service via repeated unauthenticated POST requests."}],"id":"CVE-2026-126161","lastModified":"2026-11-11T22:17:14.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.123","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-213"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126162.json b/data/2026/CVE-2026-126162.json
new file mode 100644
index 0000000000..ba76fd4785
--- /dev/null
+++ b/data/2026/CVE-2026-126162.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126162","lastModified":"2026-11-11T22:17:14.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.270","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-214"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126163.json b/data/2026/CVE-2026-126163.json
new file mode 100644
index 0000000000..6acbcc54de
--- /dev/null
+++ b/data/2026/CVE-2026-126163.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote unauthenticated attacker to execute unauthorized code or commands via a specially crafted SMTP command."}],"id":"CVE-2026-126163","lastModified":"2026-11-11T22:17:14.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.403","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-215"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126164.json b/data/2026/CVE-2026-126164.json
new file mode 100644
index 0000000000..92eff0d0dc
--- /dev/null
+++ b/data/2026/CVE-2026-126164.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126164","lastModified":"2026-11-11T22:17:14.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.537","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-216"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126165.json b/data/2026/CVE-2026-126165.json
new file mode 100644
index 0000000000..c615fbc4d7
--- /dev/null
+++ b/data/2026/CVE-2026-126165.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.9","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow a remote unauthenticated attacker to cause a denial of service via a specially crafted attachment delivered over SMTP."}],"id":"CVE-2026-126165","lastModified":"2026-11-11T22:17:14.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.673","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-217"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126166.json b/data/2026/CVE-2026-126166.json
new file mode 100644
index 0000000000..e4bf942b52
--- /dev/null
+++ b/data/2026/CVE-2026-126166.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126166","lastModified":"2026-11-11T22:17:14.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.803","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126167.json b/data/2026/CVE-2026-126167.json
new file mode 100644
index 0000000000..eb87364de1
--- /dev/null
+++ b/data/2026/CVE-2026-126167.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126167","lastModified":"2026-11-11T22:17:14.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:14.940","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126168.json b/data/2026/CVE-2026-126168.json
new file mode 100644
index 0000000000..2c8cc3d948
--- /dev/null
+++ b/data/2026/CVE-2026-126168.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126168","lastModified":"2026-11-11T22:17:15.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.067","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126169.json b/data/2026/CVE-2026-126169.json
new file mode 100644
index 0000000000..e86bd4a4c7
--- /dev/null
+++ b/data/2026/CVE-2026-126169.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.6","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.8","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.9","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.2, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions may allow an authenticated remote attacker with domain admin or admin privileges to delete users of other tenant domains on a paired FortiAuthenticator, execute arbitrary code as root or arbitrary CLI commands, and read or write arbitrary files as root via crafted HTTP requests to the administrative interface."}],"id":"CVE-2026-126169","lastModified":"2026-11-11T22:17:15.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.200","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-218"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126170.json b/data/2026/CVE-2026-126170.json
new file mode 100644
index 0000000000..f6eb60f793
--- /dev/null
+++ b/data/2026/CVE-2026-126170.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.2","status":"affected","version":"8.0.1","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzer-bigdata:7.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer-BigData","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.2","status":"affected","version":"7.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer-BigData 7.6.0 through 7.6.2, FortiManager 8.0.0 through 8.0.2, FortiManager 7.6.0 through 7.6.7, FortiManager Cloud 8.0.1 through 8.0.2, FortiManager Cloud 7.6.0 through 7.6.7 may allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted HTTP request"}],"id":"CVE-2026-126170","lastModified":"2026-11-11T22:17:15.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.340","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-219"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126171.json b/data/2026/CVE-2026-126171.json
new file mode 100644
index 0000000000..6ce5aa89df
--- /dev/null
+++ b/data/2026/CVE-2026-126171.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized commands via specially crafted HTTP request"}],"id":"CVE-2026-126171","lastModified":"2026-11-11T22:17:15.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.500","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-220"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126175.json b/data/2026/CVE-2026-126175.json
new file mode 100644
index 0000000000..d237fcd2e2
--- /dev/null
+++ b/data/2026/CVE-2026-126175.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.2","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.2 through 7.2.12, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.2 through 7.2.13, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.2 through 7.2.12, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.2 through 7.2.13 may allow an authenticated attacker to execute unauthorized code or commands via crafted JSON-RPC requests."}],"id":"CVE-2026-126175","lastModified":"2026-11-11T22:17:15.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.747","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-221"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126176.json b/data/2026/CVE-2026-126176.json
new file mode 100644
index 0000000000..54f0445c9c
--- /dev/null
+++ b/data/2026/CVE-2026-126176.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests."}],"id":"CVE-2026-126176","lastModified":"2026-11-11T22:17:15.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:15.950","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126177.json b/data/2026/CVE-2026-126177.json
new file mode 100644
index 0000000000..b95f101f7e
--- /dev/null
+++ b/data/2026/CVE-2026-126177.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an unauthenticated remote attacker to inject arbitary content into a signed SAML response via crafted SAML requests."}],"id":"CVE-2026-126177","lastModified":"2026-11-11T22:17:16.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.157","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-222"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126178.json b/data/2026/CVE-2026-126178.json
new file mode 100644
index 0000000000..4903787a2d
--- /dev/null
+++ b/data/2026/CVE-2026-126178.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via a crafted request."}],"id":"CVE-2026-126178","lastModified":"2026-11-11T22:17:16.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.370","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-223"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126179.json b/data/2026/CVE-2026-126179.json
new file mode 100644
index 0000000000..fddc252597
--- /dev/null
+++ b/data/2026/CVE-2026-126179.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests"}],"id":"CVE-2026-126179","lastModified":"2026-11-11T22:17:16.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.587","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-224"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126180.json b/data/2026/CVE-2026-126180.json
new file mode 100644
index 0000000000..33aa25da85
--- /dev/null
+++ b/data/2026/CVE-2026-126180.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a low privileged Device Manager admin to obtain super admin privilege on managed FortiGates via injecting malicious commands."}],"id":"CVE-2026-126180","lastModified":"2026-11-11T22:17:16.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.7,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.813","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-225"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126181.json b/data/2026/CVE-2026-126181.json
new file mode 100644
index 0000000000..8e478b4dff
--- /dev/null
+++ b/data/2026/CVE-2026-126181.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions may allow an adjacent-network authenticated attacker with user permission to join the FGFM configuration-sync mesh of the affected FortiGate deployment via the default pre-shared key."}],"id":"CVE-2026-126181","lastModified":"2026-11-11T22:17:16.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:16.987","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-226"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126182.json b/data/2026/CVE-2026-126182.json
new file mode 100644
index 0000000000..e0fdd8d52e
--- /dev/null
+++ b/data/2026/CVE-2026-126182.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests."}],"id":"CVE-2026-126182","lastModified":"2026-11-11T22:17:17.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.133","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126183.json b/data/2026/CVE-2026-126183.json
new file mode 100644
index 0000000000..ec5cfbba9f
--- /dev/null
+++ b/data/2026/CVE-2026-126183.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the expected scope via specially crafted HTTP request."}],"id":"CVE-2026-126183","lastModified":"2026-11-11T22:17:17.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.330","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-228"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126184.json b/data/2026/CVE-2026-126184.json
new file mode 100644
index 0000000000..5228f89ef3
--- /dev/null
+++ b/data/2026/CVE-2026-126184.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an attacker to disrupt the HA state."}],"id":"CVE-2026-126184","lastModified":"2026-11-11T22:17:17.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.603","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-229"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126185.json b/data/2026/CVE-2026-126185.json
new file mode 100644
index 0000000000..d4df6f76d5
--- /dev/null
+++ b/data/2026/CVE-2026-126185.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands via specially crafted requests."}],"id":"CVE-2026-126185","lastModified":"2026-11-11T22:17:17.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:17.830","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-230"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126211.json b/data/2026/CVE-2026-126211.json
new file mode 100644
index 0000000000..3c613142ac
--- /dev/null
+++ b/data/2026/CVE-2026-126211.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.8","status":"affected","version":"7.6.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.8","status":"affected","version":"7.6.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.1 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.1 through 7.6.8, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.1 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.1 through 7.6.8 may allow an authenticated privileged attacker to elevate their privileges via crafted JSON-RPC request."}],"id":"CVE-2026-126211","lastModified":"2026-11-11T22:17:18.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:18.100","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-231"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126212.json b/data/2026/CVE-2026-126212.json
new file mode 100644
index 0000000000..034347f683
--- /dev/null
+++ b/data/2026/CVE-2026-126212.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests."}],"id":"CVE-2026-126212","lastModified":"2026-11-11T22:17:18.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:18.263","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-232"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126213.json b/data/2026/CVE-2026-126213.json
new file mode 100644
index 0000000000..ca1213ae7f
--- /dev/null
+++ b/data/2026/CVE-2026-126213.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests."}],"id":"CVE-2026-126213","lastModified":"2026-11-11T22:17:18.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:18.457","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126214.json b/data/2026/CVE-2026-126214.json
new file mode 100644
index 0000000000..6c372916f7
--- /dev/null
+++ b/data/2026/CVE-2026-126214.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by spoofing vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126214","lastModified":"2026-11-11T22:17:18.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:18.663","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126215.json b/data/2026/CVE-2026-126215.json
new file mode 100644
index 0000000000..cef3739ec9
--- /dev/null
+++ b/data/2026/CVE-2026-126215.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126215","lastModified":"2026-11-11T22:17:18.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:18.860","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126216.json b/data/2026/CVE-2026-126216.json
new file mode 100644
index 0000000000..fb8f7d2541
--- /dev/null
+++ b/data/2026/CVE-2026-126216.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126216","lastModified":"2026-11-11T22:17:19.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.083","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126217.json b/data/2026/CVE-2026-126217.json
new file mode 100644
index 0000000000..5fc1f0ce57
--- /dev/null
+++ b/data/2026/CVE-2026-126217.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI."}],"id":"CVE-2026-126217","lastModified":"2026-11-11T22:17:19.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.240","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-234"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126218.json b/data/2026/CVE-2026-126218.json
new file mode 100644
index 0000000000..ac827ebf30
--- /dev/null
+++ b/data/2026/CVE-2026-126218.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests."}],"id":"CVE-2026-126218","lastModified":"2026-11-11T22:17:19.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.3,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.457","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-235"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126219.json b/data/2026/CVE-2026-126219.json
new file mode 100644
index 0000000000..e002abcc24
--- /dev/null
+++ b/data/2026/CVE-2026-126219.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126219","lastModified":"2026-11-11T22:17:19.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.610","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126220.json b/data/2026/CVE-2026-126220.json
new file mode 100644
index 0000000000..b88ff2fda3
--- /dev/null
+++ b/data/2026/CVE-2026-126220.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126220","lastModified":"2026-11-11T22:17:19.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.790","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126221.json b/data/2026/CVE-2026-126221.json
new file mode 100644
index 0000000000..9a1b1a4245
--- /dev/null
+++ b/data/2026/CVE-2026-126221.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements in output used by a downstream component ('injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to read or write arbitrary files or execute unauthorized code or commands via specially crafted requests to the GUI."}],"id":"CVE-2026-126221","lastModified":"2026-11-11T22:17:19.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:19.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-236"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126222.json b/data/2026/CVE-2026-126222.json
new file mode 100644
index 0000000000..6ce64433e1
--- /dev/null
+++ b/data/2026/CVE-2026-126222.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.3","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.3 through 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.3 through 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.3 through 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.3 through 7.6.7 may allow an authenticated attacker with admin privileges to execute unauthorized code or commands via crafted requests."}],"id":"CVE-2026-126222","lastModified":"2026-11-11T22:17:20.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.100","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-237"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126223.json b/data/2026/CVE-2026-126223.json
new file mode 100644
index 0000000000..2f038d078b
--- /dev/null
+++ b/data/2026/CVE-2026-126223.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted JSON-RPC requests."}],"id":"CVE-2026-126223","lastModified":"2026-11-11T22:17:20.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.243","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-238"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126224.json b/data/2026/CVE-2026-126224.json
new file mode 100644
index 0000000000..7b4f026ee1
--- /dev/null
+++ b/data/2026/CVE-2026-126224.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged admin user to execute unauthorized code or commands."}],"id":"CVE-2026-126224","lastModified":"2026-11-11T22:17:20.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.437","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-239"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126225.json b/data/2026/CVE-2026-126225.json
new file mode 100644
index 0000000000..22a67084d2
--- /dev/null
+++ b/data/2026/CVE-2026-126225.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"status":"affected","version":"7.6.7"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.7, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.7, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.7, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.7 may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request."}],"id":"CVE-2026-126225","lastModified":"2026-11-11T22:17:20.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.660","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-240"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126226.json b/data/2026/CVE-2026-126226.json
new file mode 100644
index 0000000000..744e73f89d
--- /dev/null
+++ b/data/2026/CVE-2026-126226.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted report schedule name."}],"id":"CVE-2026-126226","lastModified":"2026-11-11T22:17:20.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:20.793","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-241"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126227.json b/data/2026/CVE-2026-126227.json
new file mode 100644
index 0000000000..59993ed8ee
--- /dev/null
+++ b/data/2026/CVE-2026-126227.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute commands outside of the intended scope via specially crafted HTTP request"}],"id":"CVE-2026-126227","lastModified":"2026-11-11T22:17:21.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.003","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-242"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126228.json b/data/2026/CVE-2026-126228.json
new file mode 100644
index 0000000000..b63234482d
--- /dev/null
+++ b/data/2026/CVE-2026-126228.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.4","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.4 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.4 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.4 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.4 through 7.2.12 may allow an authenticated remote attacker with admin privileges to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126228","lastModified":"2026-11-11T22:17:21.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.243","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-243"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126229.json b/data/2026/CVE-2026-126229.json
new file mode 100644
index 0000000000..8ae02b88fe
--- /dev/null
+++ b/data/2026/CVE-2026-126229.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.16:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.15:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.14:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"},{"lessThanOrEqual":"7.0.16","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated administrator to access to other VDOMs via specially crafted HTTP requests."}],"id":"CVE-2026-126229","lastModified":"2026-11-11T22:17:21.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.447","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-244"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126230.json b/data/2026/CVE-2026-126230.json
new file mode 100644
index 0000000000..23fb695b2f
--- /dev/null
+++ b/data/2026/CVE-2026-126230.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to execute unauthorized code or commands or cause a denial of service via specially crafted requests."}],"id":"CVE-2026-126230","lastModified":"2026-11-11T22:17:21.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.697","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-245"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126231.json b/data/2026/CVE-2026-126231.json
new file mode 100644
index 0000000000..7b406cf35f
--- /dev/null
+++ b/data/2026/CVE-2026-126231.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request."}],"id":"CVE-2026-126231","lastModified":"2026-11-11T22:17:21.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:21.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-246"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126232.json b/data/2026/CVE-2026-126232.json
new file mode 100644
index 0000000000..26f5d2f448
--- /dev/null
+++ b/data/2026/CVE-2026-126232.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.13:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper certificate validation vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow a MITM attacker to impersonate the radius server via a rogue RADIUS server."}],"id":"CVE-2026-126232","lastModified":"2026-11-11T22:17:22.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.157","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-247"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126233.json b/data/2026/CVE-2026-126233.json
new file mode 100644
index 0000000000..b9773236ff
--- /dev/null
+++ b/data/2026/CVE-2026-126233.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to upload arbitrary files via specially crafted requests."}],"id":"CVE-2026-126233","lastModified":"2026-11-11T22:17:22.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.377","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-248"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126234.json b/data/2026/CVE-2026-126234.json
new file mode 100644
index 0000000000..e703cf3df8
--- /dev/null
+++ b/data/2026/CVE-2026-126234.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restricted privileges to execute unauthorized code or commands via a specially crafted request."}],"id":"CVE-2026-126234","lastModified":"2026-11-11T22:17:22.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.607","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-249"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126235.json b/data/2026/CVE-2026-126235.json
new file mode 100644
index 0000000000..0e52de2038
--- /dev/null
+++ b/data/2026/CVE-2026-126235.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.2","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.7","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.10","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.2 through 7.6.7, FortiAnalyzer 7.4.7 through 7.4.11, FortiAnalyzer 7.2.10 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.2 through 7.6.7, FortiManager 7.4.7 through 7.4.11, FortiManager 7.2.10 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to write arbitrary files via a specially crafted archive."}],"id":"CVE-2026-126235","lastModified":"2026-11-11T22:17:22.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.753","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-250"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126236.json b/data/2026/CVE-2026-126236.json
new file mode 100644
index 0000000000..68d12cd3b1
--- /dev/null
+++ b/data/2026/CVE-2026-126236.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.1"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted HTTP requests"}],"id":"CVE-2026-126236","lastModified":"2026-11-11T22:17:22.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:22.960","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-251"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126237.json b/data/2026/CVE-2026-126237.json
new file mode 100644
index 0000000000..ac61c02475
--- /dev/null
+++ b/data/2026/CVE-2026-126237.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A loop with unreachable exit condition ('infinite loop') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to cause a denial of service via crafted TCP requests."}],"id":"CVE-2026-126237","lastModified":"2026-11-11T22:17:23.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.177","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-252"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126238.json b/data/2026/CVE-2026-126238.json
new file mode 100644
index 0000000000..e9b83b7bdf
--- /dev/null
+++ b/data/2026/CVE-2026-126238.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality."}],"id":"CVE-2026-126238","lastModified":"2026-11-11T22:17:23.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.313","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-253"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126239.json b/data/2026/CVE-2026-126239.json
new file mode 100644
index 0000000000..b980f94ffc
--- /dev/null
+++ b/data/2026/CVE-2026-126239.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests"}],"id":"CVE-2026-126239","lastModified":"2026-11-11T22:17:23.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.460","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-254"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126240.json b/data/2026/CVE-2026-126240.json
new file mode 100644
index 0000000000..c2fb5ad8d7
--- /dev/null
+++ b/data/2026/CVE-2026-126240.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username)."}],"id":"CVE-2026-126240","lastModified":"2026-11-11T22:17:23.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.617","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-255"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-90"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126241.json b/data/2026/CVE-2026-126241.json
new file mode 100644
index 0000000000..13d5e93cba
--- /dev/null
+++ b/data/2026/CVE-2026-126241.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"},{"lessThanOrEqual":"6.5.7","status":"affected","version":"6.5.2","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database."}],"id":"CVE-2026-126241","lastModified":"2026-11-11T22:17:23.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.753","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-256"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126242.json b/data/2026/CVE-2026-126242.json
new file mode 100644
index 0000000000..ea97e646ec
--- /dev/null
+++ b/data/2026/CVE-2026-126242.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means."}],"id":"CVE-2026-126242","lastModified":"2026-11-11T22:17:23.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:23.893","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126243.json b/data/2026/CVE-2026-126243.json
new file mode 100644
index 0000000000..d49ea938c7
--- /dev/null
+++ b/data/2026/CVE-2026-126243.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means."}],"id":"CVE-2026-126243","lastModified":"2026-11-11T22:17:24.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.020","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126244.json b/data/2026/CVE-2026-126244.json
new file mode 100644
index 0000000000..3ef03d7e84
--- /dev/null
+++ b/data/2026/CVE-2026-126244.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS)."}],"id":"CVE-2026-126244","lastModified":"2026-11-11T22:17:24.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.147","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-258"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126245.json b/data/2026/CVE-2026-126245.json
new file mode 100644
index 0000000000..6cec813142
--- /dev/null
+++ b/data/2026/CVE-2026-126245.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections."}],"id":"CVE-2026-126245","lastModified":"2026-11-11T22:17:24.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.280","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-259"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126246.json b/data/2026/CVE-2026-126246.json
new file mode 100644
index 0000000000..d32bcc6a00
--- /dev/null
+++ b/data/2026/CVE-2026-126246.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A null pointer dereference vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform a denial of service attack via http requests."}],"id":"CVE-2026-126246","lastModified":"2026-11-11T22:17:24.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.423","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-260"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126247.json b/data/2026/CVE-2026-126247.json
new file mode 100644
index 0000000000..3f6b0e3a63
--- /dev/null
+++ b/data/2026/CVE-2026-126247.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests."}],"id":"CVE-2026-126247","lastModified":"2026-11-11T22:17:24.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.560","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-261"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126248.json b/data/2026/CVE-2026-126248.json
new file mode 100644
index 0000000000..a31478fab3
--- /dev/null
+++ b/data/2026/CVE-2026-126248.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests."}],"id":"CVE-2026-126248","lastModified":"2026-11-11T22:17:24.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.693","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126249.json b/data/2026/CVE-2026-126249.json
new file mode 100644
index 0000000000..ad12ad3b50
--- /dev/null
+++ b/data/2026/CVE-2026-126249.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges."}],"id":"CVE-2026-126249","lastModified":"2026-11-11T22:17:24.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.823","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-263"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126250.json b/data/2026/CVE-2026-126250.json
new file mode 100644
index 0000000000..15142d82a3
--- /dev/null
+++ b/data/2026/CVE-2026-126250.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to cause a denial of service via HTTP requests."}],"id":"CVE-2026-126250","lastModified":"2026-11-11T22:17:24.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:24.960","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-264"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126251.json b/data/2026/CVE-2026-126251.json
new file mode 100644
index 0000000000..f8b756e80f
--- /dev/null
+++ b/data/2026/CVE-2026-126251.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access."}],"id":"CVE-2026-126251","lastModified":"2026-11-11T22:17:25.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.087","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-265"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126252.json b/data/2026/CVE-2026-126252.json
new file mode 100644
index 0000000000..37e1428b35
--- /dev/null
+++ b/data/2026/CVE-2026-126252.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests"}],"id":"CVE-2026-126252","lastModified":"2026-11-11T22:17:25.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.220","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-266"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126253.json b/data/2026/CVE-2026-126253.json
new file mode 100644
index 0000000000..ba52846e36
--- /dev/null
+++ b/data/2026/CVE-2026-126253.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A authentication bypass by primary weakness vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker to broadcast LSA via specially crafted request"}],"id":"CVE-2026-126253","lastModified":"2026-11-11T22:17:25.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.347","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-267"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-305"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126254.json b/data/2026/CVE-2026-126254.json
new file mode 100644
index 0000000000..3a26b0de34
--- /dev/null
+++ b/data/2026/CVE-2026-126254.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request"}],"id":"CVE-2026-126254","lastModified":"2026-11-11T22:17:25.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.490","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-268"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-197"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126255.json b/data/2026/CVE-2026-126255.json
new file mode 100644
index 0000000000..45c0f8493a
--- /dev/null
+++ b/data/2026/CVE-2026-126255.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortipam:1.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.5.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.3.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.1.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiPAM","vendor":"Fortinet","versions":[{"lessThanOrEqual":"1.6.2","status":"affected","version":"1.6.0","versionType":"semver"},{"lessThanOrEqual":"1.5.1","status":"affected","version":"1.5.0","versionType":"semver"},{"lessThanOrEqual":"1.4.3","status":"affected","version":"1.4.0","versionType":"semver"},{"lessThanOrEqual":"1.3.1","status":"affected","version":"1.3.0","versionType":"semver"},{"status":"affected","version":"1.2.0"},{"lessThanOrEqual":"1.1.2","status":"affected","version":"1.1.0","versionType":"semver"},{"lessThanOrEqual":"1.0.3","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an unauthenticated attacker to bypass authentication via specially crafted credentials."}],"id":"CVE-2026-126255","lastModified":"2026-11-11T22:17:25.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.623","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-269"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-24"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126256.json b/data/2026/CVE-2026-126256.json
new file mode 100644
index 0000000000..8093528032
--- /dev/null
+++ b/data/2026/CVE-2026-126256.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.14:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.13","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.14","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets."}],"id":"CVE-2026-126256","lastModified":"2026-11-11T22:17:25.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.783","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-270"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126257.json b/data/2026/CVE-2026-126257.json
new file mode 100644
index 0000000000..d95e04d0f3
--- /dev/null
+++ b/data/2026/CVE-2026-126257.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortiauthenticator:8.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAuthenticator","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access."}],"id":"CVE-2026-126257","lastModified":"2026-11-11T22:17:25.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":6.0,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:25.930","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-271"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-259"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126258.json b/data/2026/CVE-2026-126258.json
new file mode 100644
index 0000000000..17a6c97a30
--- /dev/null
+++ b/data/2026/CVE-2026-126258.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"status":"affected","version":"7.6.7"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.7 may allow an unauthenticated attacker with wad port access to crash proxy or ZTNA sessions via crafted HTTP or HTTPS requests."}],"id":"CVE-2026-126258","lastModified":"2026-11-11T22:17:26.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:26.073","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-272"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126259.json b/data/2026/CVE-2026-126259.json
new file mode 100644
index 0000000000..691f805a9f
--- /dev/null
+++ b/data/2026/CVE-2026-126259.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortios:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiOS","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"},{"lessThanOrEqual":"7.0.19","status":"affected","version":"7.0.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or autoscale to execute command as super admin via crafted HA packets."}],"id":"CVE-2026-126259","lastModified":"2026-11-11T22:17:26.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:26.200","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-273"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126262.json b/data/2026/CVE-2026-126262.json
new file mode 100644
index 0000000000..8d4adb1880
--- /dev/null
+++ b/data/2026/CVE-2026-126262.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12 may allow an unauthenticated attacker who has access to the oftp port to execute code or command on the system via crafted OFTP packets."}],"id":"CVE-2026-126262","lastModified":"2026-11-11T22:17:26.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:26.343","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-276"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126263.json b/data/2026/CVE-2026-126263.json
new file mode 100644
index 0000000000..7f3bcd47ec
--- /dev/null
+++ b/data/2026/CVE-2026-126263.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortimail:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimail:7.4.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiMail","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.4","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.6","status":"affected","version":"7.4.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted requests."}],"id":"CVE-2026-126263","lastModified":"2026-11-11T22:17:26.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-11T22:17:26.520","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-277"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126326.json b/data/2026/CVE-2026-126326.json
new file mode 100644
index 0000000000..9ca9761dfe
--- /dev/null
+++ b/data/2026/CVE-2026-126326.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Server","vendor":"Devolutions","versions":[{"lessThan":"2026.3.14","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@devolutions.net"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request."}],"id":"CVE-2026-126326","lastModified":"2026-11-11T22:17:26.763","metrics":{},"published":"2026-11-11T22:17:26.663","references":[{"source":"security@devolutions.net","url":"https://devolutions.net/security/advisories/DEVO-2026-0041/"}],"sourceIdentifier":"security@devolutions.net","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@devolutions.net","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126327.json b/data/2026/CVE-2026-126327.json
new file mode 100644
index 0000000000..1d58b2876a
--- /dev/null
+++ b/data/2026/CVE-2026-126327.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Server","vendor":"Devolutions","versions":[{"lessThan":"2026.3.14","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@devolutions.net"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API."}],"id":"CVE-2026-126327","lastModified":"2026-11-11T22:17:26.900","metrics":{},"published":"2026-11-11T22:17:26.797","references":[{"source":"security@devolutions.net","url":"https://devolutions.net/security/advisories/DEVO-2026-0041/"}],"sourceIdentifier":"security@devolutions.net","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@devolutions.net","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126328.json b/data/2026/CVE-2026-126328.json
new file mode 100644
index 0000000000..98cd8a4291
--- /dev/null
+++ b/data/2026/CVE-2026-126328.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Server","vendor":"Devolutions","versions":[{"lessThan":"2026.3.14","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@devolutions.net"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses."}],"id":"CVE-2026-126328","lastModified":"2026-11-11T22:17:27.060","metrics":{},"published":"2026-11-11T22:17:26.950","references":[{"source":"security@devolutions.net","url":"https://devolutions.net/security/advisories/DEVO-2026-0041/"}],"sourceIdentifier":"security@devolutions.net","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"security@devolutions.net","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126331.json b/data/2026/CVE-2026-126331.json
new file mode 100644
index 0000000000..a462ebf61b
--- /dev/null
+++ b/data/2026/CVE-2026-126331.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Server","vendor":"Devolutions","versions":[{"lessThan":"2026.3.14","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@devolutions.net"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response."}],"id":"CVE-2026-126331","lastModified":"2026-11-11T22:17:27.180","metrics":{},"published":"2026-11-11T22:17:27.090","references":[{"source":"security@devolutions.net","url":"https://devolutions.net/security/advisories/DEVO-2026-0041/"}],"sourceIdentifier":"security@devolutions.net","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"security@devolutions.net","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126332.json b/data/2026/CVE-2026-126332.json
new file mode 100644
index 0000000000..6ee1952ebb
--- /dev/null
+++ b/data/2026/CVE-2026-126332.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Server","vendor":"Devolutions","versions":[{"lessThan":"2026.3.14","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@devolutions.net"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault."}],"id":"CVE-2026-126332","lastModified":"2026-11-11T22:17:27.313","metrics":{},"published":"2026-11-11T22:17:27.217","references":[{"source":"security@devolutions.net","url":"https://devolutions.net/security/advisories/DEVO-2026-0041/"}],"sourceIdentifier":"security@devolutions.net","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@devolutions.net","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126797.json b/data/2026/CVE-2026-126797.json
new file mode 100644
index 0000000000..95c81cd839
--- /dev/null
+++ b/data/2026/CVE-2026-126797.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:docker/lysec/ns-admin","product":"NextScan","vendor":"tongcheng-security-team","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"1.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carrying the public super administrator role ID to gain full access to user management, scan tasks and stored vulnerability results."}],"id":"CVE-2026-126797","lastModified":"2026-11-11T21:16:43.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.027","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tongcheng-security-team/NextScan/blob/v1.2.0/docker/docker-compose.yaml"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tongcheng-security-team/NextScan/issues/48"},{"source":"disclosure@vulncheck.com","url":"https://hub.docker.com/r/lysec/ns-admin"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/nextscan/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-jwt-key-authentication-bypass-in-ns-admin"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126798.json b/data/2026/CVE-2026-126798.json
new file mode 100644
index 0000000000..a33aeb10c6
--- /dev/null
+++ b/data/2026/CVE-2026-126798.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:docker/lysec/ns-admin","product":"NextScan","vendor":"tongcheng-security-team","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"1.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators."}],"id":"CVE-2026-126798","lastModified":"2026-11-11T21:16:43.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.190","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tongcheng-security-team/NextScan/issues/49"},{"source":"disclosure@vulncheck.com","url":"https://hub.docker.com/r/lysec/ns-admin"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/nextscan/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-stored-xss-via-url-asset-detail-view"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126799.json b/data/2026/CVE-2026-126799.json
new file mode 100644
index 0000000000..4ce7e70fc9
--- /dev/null
+++ b/data/2026/CVE-2026-126799.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/gotenberg/gotenberg/v8","product":"gotenberg","vendor":"gotenberg","versions":[{"lessThan":"8.38.0","status":"affected","version":"8.31.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6 prefixes in downloadFrom, webhook, or Chromium/LibreOffice URLs to reach internal services and read responses in the returned PDF."}],"id":"CVE-2026-126799","lastModified":"2026-11-11T21:16:43.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.347","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/blob/v8.37.0/pkg/gotenberg/outbound.go#L112-L142"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/commit/8e850b1c932452627fba397f2005dd6fd57b9617"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/releases/tag/v8.38.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fqg9-x2xw-5crx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gotenberg-8.31.0-before-8.38.0-ssrf-via-ipv6-zone-identifiers-in-ispublicip"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126800.json b/data/2026/CVE-2026-126800.json
new file mode 100644
index 0000000000..91eac7fa6f
--- /dev/null
+++ b/data/2026/CVE-2026-126800.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/%40hydrooj/ui-default","product":"@hydrooj/ui-default","vendor":"hydro-dev","versions":[{"lessThan":"4.59.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hydro @hydrooj/ui-default before 4.59.1 contains a stored cross-site scripting vulnerability that allows registered users to inject script by placing double quotes in language- class tokens within markdown-it-xss.ts. Attackers can store a payload in their profile bio that executes when administrators or other users view it, stealing the non-httpOnly sid session cookie for session hijacking."}],"id":"CVE-2026-126800","lastModified":"2026-11-11T21:16:43.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.507","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/hydro-dev/Hydro/blob/3c8286dd1350fcd00412e95d5b056dbfed64edda/packages/ui-default/backendlib/markdown-it-xss.ts#L150-L157"},{"source":"disclosure@vulncheck.com","url":"https://github.com/hydro-dev/Hydro/commit/3bae56fe8edddff12346bcb1c8281269c94688d8"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/hydro/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/hydro-hydrooj-ui-default-before-4.59.1-stored-xss-via-markdown-language-class"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126801.json b/data/2026/CVE-2026-126801.json
new file mode 100644
index 0000000000..dbf0689dd6
--- /dev/null
+++ b/data/2026/CVE-2026-126801.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/rabithua/rote","product":"Rote","vendor":"Rabithua","versions":[{"lessThanOrEqual":"2.6.0","status":"affected","version":"1.2.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rote 1.2.0 through 2.6.0 contains an authorization bypass in the OAuth bind/merge endpoint that allows authenticated users to merge any OAuth-bound account into their own. Attackers can submit a public existingUserId and GitHub or Apple user ID to take over notes, attachments, and API keys and delete the victim account."}],"id":"CVE-2026-126801","lastModified":"2026-11-11T21:16:43.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/oauth.ts#L596-L659"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/pull/420"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261104/rote/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rote-1.2.0-through-2.6.0-account-takeover-via-oauth-account-merge-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126802.json b/data/2026/CVE-2026-126802.json
new file mode 100644
index 0000000000..e9742c43ed
--- /dev/null
+++ b/data/2026/CVE-2026-126802.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:docker/lysec/ns-admin","product":"NextScan","vendor":"tongcheng-security-team","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"1.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints."}],"id":"CVE-2026-126802","lastModified":"2026-11-11T21:16:43.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.837","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tongcheng-security-team/NextScan/issues/50"},{"source":"disclosure@vulncheck.com","url":"https://hub.docker.com/r/lysec/ns-admin"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/nextscan/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126803.json b/data/2026/CVE-2026-126803.json
new file mode 100644
index 0000000000..60d071c44b
--- /dev/null
+++ b/data/2026/CVE-2026-126803.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/rabithua/rote","product":"Rote","vendor":"Rabithua","versions":[{"lessThanOrEqual":"2.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rote through 2.6.0 contains a privilege escalation vulnerability that allows authenticated admins to obtain super_admin rights by reading or overwriting JWT signing secrets via /v2/api/admin/settings. Attackers can retrieve the unmasked jwtSecret from the security settings group and forge HS256 tokens for the super administrator to change user roles and escalate their own account."}],"id":"CVE-2026-126803","lastModified":"2026-11-11T21:16:44.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.007","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/blob/v2.6.0/server/route/v2/admin.ts#L86-L146"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/commit/865d69fceb9c1f1a0d30923fae7cef072a38b22b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Rabithua/Rote/pull/420"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261104/rote/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rote-through-2.6.0-privilege-escalation-via-admin-settings-api-jwt-secret-exposure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126804.json b/data/2026/CVE-2026-126804.json
new file mode 100644
index 0000000000..8a6e107fc3
--- /dev/null
+++ b/data/2026/CVE-2026-126804.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"12.4","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated is_regular_user parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer."}],"id":"CVE-2026-126804","lastModified":"2026-11-11T21:16:44.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/ADs/ADs.php#L194-L219"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/ADs/deleteImage.json.php#L53-L63"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/c2b99663d6442e2182a0f3ab95ea6731a193b301"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-58h3-9722-fgpm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.7.1-path-traversal-file-deletion-via-deleteimage-json-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126805.json b/data/2026/CVE-2026-126805.json
new file mode 100644
index 0000000000..6d27f7b09a
--- /dev/null
+++ b/data/2026/CVE-2026-126805.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo through 29.7.1 contains an incorrect authorization vulnerability that allows delegated Videos Admin users to obtain video_id_hash values bound to any video owner via encoder endpoints like aVideoEncoderStatus.json.php. Attackers can request the hash for an administrator-owned video and replay it through useVideoHashOrLogin() for password-less login, gaining plugin upload, configuration, and user management access."}],"id":"CVE-2026-126805","lastModified":"2026-11-11T21:16:44.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.373","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/EncoderJobStatus.php#L31-L42"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/functions.php#L7619-L7647"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/8252cb87de0639ae4d8c84c03d46f657948dca07"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-8wjr-gw73-9f2g"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-privilege-escalation-via-encoder-video-id-hash"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126806.json b/data/2026/CVE-2026-126806.json
new file mode 100644
index 0000000000..5532d26072
--- /dev/null
+++ b/data/2026/CVE-2026-126806.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"14.3","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP."}],"id":"CVE-2026-126806","lastModified":"2026-11-11T21:16:44.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.583","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/functionTags.php#L198-L221"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/view/managerVideos_body.php#L1997-L2011"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/da1da205608d57b1e695a7fad8288a2f5f9a0e0f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-14.3-through-29.7.1-stored-xss-via-video-source-tag"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126807.json b/data/2026/CVE-2026-126807.json
new file mode 100644
index 0000000000..c0280e2e49
--- /dev/null
+++ b/data/2026/CVE-2026-126807.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/asternic/wuzapi","product":"wuzapi","vendor":"asternic","versions":[{"lessThanOrEqual":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chat_jid=index to list every user's internal ID, stored chat JIDs, and last-message times."}],"id":"CVE-2026-126807","lastModified":"2026-11-11T21:16:44.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.800","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/blob/v1.1.0/handlers.go#L7269-L7296"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/blob/v1.1.0/routes.go#L139"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/commit/f5332fa21b7c8a742f9ee565328ea776ad0c8040"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asternic/wuzapi/issues/407"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/wuzapi-chat-history-index-cross-tenant-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wuzapi-through-1.1.0-cross-tenant-information-disclosure-via-chat-history"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126808.json b/data/2026/CVE-2026-126808.json
new file mode 100644
index 0000000000..d55639bfc4
--- /dev/null
+++ b/data/2026/CVE-2026-126808.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/wp-erp/wp-erp","product":"ERP","vendor":"weDevs","versions":[{"lessThanOrEqual":"1.17.11","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own HR records because HRM AJAX handlers check erp_edit_employee instead of erp_manage_jobinfo. Attackers can post their own user_id with the My Profile nonce to change designation, reporting manager, pay rate, and employment type, or delete job history."}],"id":"CVE-2026-126808","lastModified":"2026-11-11T21:16:44.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.963","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/AjaxHandler.php#L1190-L1225"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/blob/v1.17.11/modules/hrm/includes/functions-capabilities.php#L228-L263"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/commit/54666918b67f39882636f97a6ee846624ed14eb0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/issues/1691"},{"source":"disclosure@vulncheck.com","url":"https://github.com/wp-erp/wp-erp/pull/1693"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wp-erp-through-1.17.11-incorrect-authorization-via-hrm-job-info-ajax-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126809.json b/data/2026/CVE-2026-126809.json
new file mode 100644
index 0000000000..2487e6fc6d
--- /dev/null
+++ b/data/2026/CVE-2026-126809.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, read victims' .txt/.html sidecars as descriptions, list files via objects/listFiles.json.php, and delete victims' media using the delete parameter."}],"id":"CVE-2026-126809","lastModified":"2026-11-11T21:16:45.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.133","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/import.json.php#L16-L81"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/listFiles.json.php#L15-L35"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/02471a4ddab0c5e28d74784b89298e489c17aff0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-g69x-xc9q-2g2v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-objects-import-json-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126810.json b/data/2026/CVE-2026-126810.json
new file mode 100644
index 0000000000..8f46cf2bf2
--- /dev/null
+++ b/data/2026/CVE-2026-126810.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"29.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed."}],"id":"CVE-2026-126810","lastModified":"2026-11-11T21:16:45.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/index.php#L143-L169"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/rss-style.xsl#L32-L41"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-29.1.0-through-29.7.1-stored-xss-via-channel-rss-feed"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126811.json b/data/2026/CVE-2026-126811.json
new file mode 100644
index 0000000000..c414052dc4
--- /dev/null
+++ b/data/2026/CVE-2026-126811.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/BookStackApp/BookStack","product":"BookStack","vendor":"BookStackApp","versions":[{"lessThan":"26.09.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublished draft page images by checking only PageView permission without draft status. Attackers can read drawio data via the base64 endpoint or rename, replace, or delete draft images by sequential ID to disclose or tamper with unpublished work."}],"id":"CVE-2026-126811","lastModified":"2026-11-11T21:16:45.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.507","references":[{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/commit/4fec06236cbfb314fd72c1b3614c7c50162fb41c"},{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/commit/926e16a23f346be47d44746d14cba40cb355cbe1"},{"source":"disclosure@vulncheck.com","url":"https://codeberg.org/bookstack/bookstack/releases/tag/v26.09.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/DrawioImageController.php#L82-L92"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/blob/v26.09.2/app/Uploads/Controllers/ImageController.php#L159-L169"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/commit/926e16a23f346be47d44746d14cba40cb355cbe1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/BookStackApp/BookStack/releases/tag/v26.09.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/fishtankyu/bookstack-draft-image-idor-advisory.md"},{"source":"disclosure@vulncheck.com","url":"https://www.bookstackapp.com/blog/bookstack-release-v26-09-3/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bookstack-before-26.09.3-incorrect-authorization-via-image-and-drawio-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126812.json b/data/2026/CVE-2026-126812.json
new file mode 100644
index 0000000000..3aa0eda9e0
--- /dev/null
+++ b/data/2026/CVE-2026-126812.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blueprintue/blueprintue-self-hosted-edition","product":"blueprintue-self-hosted-edition","vendor":"blueprintue","versions":[{"lessThan":"4.3.7","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases."}],"id":"CVE-2026-126812","lastModified":"2026-11-11T21:16:45.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.690","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.6/docker-examples/database.env"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.6/docker-examples/docker-compose-smtp.yml#L14-L24"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/e6a6e1d4c2f22efbbabf9fb31ec479544405b469"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/270"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.7"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-9f6r-vjc7-jq67"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.7-empty-mariadb-root-password-via-docker-compose"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-258"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126813.json b/data/2026/CVE-2026-126813.json
new file mode 100644
index 0000000000..94bf5622ff
--- /dev/null
+++ b/data/2026/CVE-2026-126813.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/roundcube/roundcubemail","product":"Webmail","vendor":"Roundcube","versions":[{"lessThan":"1.6.21","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.7.6","status":"affected","version":"1.7.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL."}],"id":"CVE-2026-126813","lastModified":"2026-11-11T21:16:45.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.883","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/blob/1.7.5/program/lib/Roundcube/rcube_imap_generic.php#L2892"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/2ea63692178cab5cea486c7c630901b7f6852c80"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/4cb1cf106b9ca5d465ed4924f2fab5d5108edfeb"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/commit/d1dda13597ceed9df49d434a8d88b758bcf6ef5c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.21"},{"source":"disclosure@vulncheck.com","url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.6"},{"source":"disclosure@vulncheck.com","url":"https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/roundcube-webmail-before-1.6.21-and-1.7.6-imap-command-injection-via-uid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126814.json b/data/2026/CVE-2026-126814.json
new file mode 100644
index 0000000000..47942b5213
--- /dev/null
+++ b/data/2026/CVE-2026-126814.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blueprintue/blueprintue-self-hosted-edition","product":"blueprintue-self-hosted-edition","vendor":"blueprintue","versions":[{"lessThan":"4.3.6","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads."}],"id":"CVE-2026-126814","lastModified":"2026-11-11T21:16:46.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.053","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.5/app/services/www/BlueprintService.php#L700-L716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/5f13e2bb8cd4c620899e9f8afd41a6e62b3bc6a4"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/269"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-3vgc-fcfg-v233"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.6-arbitrary-iframe-embedding-via-peertube-matcher"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-26204.json b/data/2026/CVE-2026-26204.json
index 84e6769acc..1eb1cdae6b 100644
--- a/data/2026/CVE-2026-26204.json
+++ b/data/2026/CVE-2026-26204.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 1.0.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"B5795082-289E-455E-B5BE-929CF35FB92A","versionEndExcluding":"4.14.4","versionStartIncluding":"1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4."}],"id":"CVE-2026-26204","lastModified":"2026-06-17T10:25:56.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-26204","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:48:02.731556Z","version":"2.0.3"}}]},"published":"2026-04-29T18:16:04.820","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"},{"lang":"en","value":"CWE-191"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 1.0.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"B5795082-289E-455E-B5BE-929CF35FB92A","versionEndExcluding":"4.14.4","versionStartIncluding":"1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a compromised agent to cause denial of service or heap corruption by injecting a specially crafted alert into the alerts log file monitored by wazuh-logcollector. This issue has been patched in version 4.14.4."},{"lang":"es","value":"Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta a amenazas. Desde la versión 1.0.0 hasta antes de la versión 4.14.4, se produce una ESCRITURA fuera de límites basada en el heap en GetAlertData, lo que resulta en la escritura de un byte NULL exactamente 1 byte antes del inicio del búfer asignado por strdup. Debido a un desbordamiento inferior de entero sin signo y al ajuste de la aritmética de punteros, la escritura se produce en el desplazamiento -1 desde el búfer, corrompiendo los metadatos del heap. Un actor malicioso puede potencialmente aprovechar este problema a través de un agente comprometido para causar denegación de servicio o corrupción del heap inyectando una alerta especialmente diseñada en el archivo de registro de alertas monitoreado por wazuh-logcollector. Este problema ha sido parcheado en la versión 4.14.4."}],"id":"CVE-2026-26204","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-26204","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:48:02.731556Z","version":"2.0.3"}}]},"published":"2026-04-29T18:16:04.820","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-j4c7-hwjw-8857"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"},{"lang":"en","value":"CWE-191"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-26206.json b/data/2026/CVE-2026-26206.json
index e08e2cdcb5..73e07d2652 100644
--- a/data/2026/CVE-2026-26206.json
+++ b/data/2026/CVE-2026-26206.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.0.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"8147D947-167A-4F70-A689-81B33A161A83","versionEndExcluding":"4.14.4","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4."}],"id":"CVE-2026-26206","lastModified":"2026-06-17T10:25:56.480","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-26206","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:49:39.034788Z","version":"2.0.3"}}]},"published":"2026-04-29T19:16:22.600","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-367"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.0.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"8147D947-167A-4F70-A689-81B33A161A83","versionEndExcluding":"4.14.4","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is applied. This enables an attacker to perform more password guesses than the configured policy intends (e.g., 100 attempts processed where 50 should be allowed). This issue has been patched in version 4.14.4."},{"lang":"es","value":"Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta a amenazas. Desde la versión 4.0.0 hasta antes de la versión 4.14.4, la protección contra ataques de fuerza bruta de la API del servidor de Wazuh para POST /security/user/authenticate puede ser eludida enviando solicitudes de autenticación concurrentes. Aunque el umbral configurado (max_login_attempts, predeterminado 50) se aplica correctamente para solicitudes secuenciales, una ráfaga paralela permite procesar significativamente más intentos de inicio de sesión fallidos antes de que se aplique el bloqueo de IP. Esto permite a un atacante realizar más intentos de adivinación de contraseñas de lo que la política configurada pretende (por ejemplo, 100 intentos procesados donde se deberían permitir 50). Este problema ha sido parcheado en la versión 4.14.4."}],"id":"CVE-2026-26206","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-26206","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:49:39.034788Z","version":"2.0.3"}}]},"published":"2026-04-29T19:16:22.600","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-m2mr-xhhv-jx58"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-367"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-27644.json b/data/2026/CVE-2026-27644.json
index 5b9d647c1e..af6105ad4b 100644
--- a/data/2026/CVE-2026-27644.json
+++ b/data/2026/CVE-2026-27644.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"traccar","vendor":"traccar","versions":[{"status":"affected","version":">= 6.11.1 , < 6.13.0"}]},{"product":"traccar","vendor":"traccar","versions":[{"status":"affected","version":">= 6.11.1 , < 6.13.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*","matchCriteriaId":"A453268E-69E6-4CE2-A341-8890520DF28E","versionEndExcluding":"6.13.0","versionStartIncluding":"6.11.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0."}],"id":"CVE-2026-27644","lastModified":"2026-06-17T10:27:26.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-27644","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T13:10:57.348926Z","version":"2.0.3"}}]},"published":"2026-05-05T13:16:27.807","references":[{"source":"security-advisories@github.com","tags":["Product"],"url":"https://github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvExportProvider.java#L89-L91"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1236"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"traccar","vendor":"traccar","versions":[{"status":"affected","version":">= 6.11.1 , < 6.13.0"}]},{"product":"traccar","vendor":"traccar","versions":[{"status":"affected","version":">= 6.11.1 , < 6.13.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*","matchCriteriaId":"A453268E-69E6-4CE2-A341-8890520DF28E","versionEndExcluding":"6.13.0","versionStartIncluding":"6.11.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0."},{"lang":"es","value":"Traccar es un sistema de seguimiento GPS de código abierto. En versiones entre la 6.11.1 y la 6.13.0, la funcionalidad de exportación CSV escribe datos de posición, incluyendo atributos de dispositivo controlados por el usuario y atributos calculados, a la salida CSV sin el escape adecuado. Un atacante puede inyectar fórmulas de hoja de cálculo a través de campos exportados. Cuando un gerente o administrador abre el archivo CSV exportado en software de hoja de cálculo, esto puede causar la ejecución de fórmulas y conducir a la ejecución de comandos o la exfiltración de datos. Esto ha sido parcheado en la versión 6.13.0."}],"id":"CVE-2026-27644","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-27644","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T13:10:57.348926Z","version":"2.0.3"}}]},"published":"2026-05-05T13:16:27.807","references":[{"source":"security-advisories@github.com","tags":["Product"],"url":"https://github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvExportProvider.java#L89-L91"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1236"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-27693.json b/data/2026/CVE-2026-27693.json
index da6301f230..6d2d23d760 100644
--- a/data/2026/CVE-2026-27693.json
+++ b/data/2026/CVE-2026-27693.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"traccar","vendor":"traccar","versions":[{"status":"affected","version":">= 6.11.1, < 6.13.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*","matchCriteriaId":"A453268E-69E6-4CE2-A341-8890520DF28E","versionEndExcluding":"6.13.0","versionStartIncluding":"6.11.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0."}],"id":"CVE-2026-27693","lastModified":"2026-06-17T10:27:31.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-27693","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-06T12:43:06.299961Z","version":"2.0.3"}}]},"published":"2026-05-05T13:16:28.367","references":[{"source":"security-advisories@github.com","tags":["Product"],"url":"https://github.com/traccar/traccar/blob/v6.11.0/src/main/java/org/traccar/reports/GpxExportProvider.java#L52-L54"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"traccar","vendor":"traccar","versions":[{"status":"affected","version":">= 6.11.1, < 6.13.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*","matchCriteriaId":"A453268E-69E6-4CE2-A341-8890520DF28E","versionEndExcluding":"6.13.0","versionStartIncluding":"6.11.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes device names to XML output without proper escaping. An attacker with low privileges can create a device with a crafted name that injects XML content into exported files. If another user exports and opens the affected KML or GPX file, this can corrupt the file structure and spoof exported location data. This issue is fixed in version 6.13.0."},{"lang":"es","value":"Traccar es un sistema de seguimiento GPS de código abierto. En las versiones de org.traccar:traccar a partir de la 6.11.1 y anteriores a la 6.13.0, la funcionalidad de exportación KML y GPX escribe los nombres de los dispositivos a la salida XML sin el escape adecuado. Un atacante con privilegios bajos puede crear un dispositivo con un nombre manipulado que inyecta contenido XML en los archivos exportados. Si otro usuario exporta y abre el archivo KML o GPX afectado, esto puede corromper la estructura del archivo y falsificar los datos de ubicación exportados. Este problema está solucionado en la versión 6.13.0."}],"id":"CVE-2026-27693","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-27693","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-06T12:43:06.299961Z","version":"2.0.3"}}]},"published":"2026-05-05T13:16:28.367","references":[{"source":"security-advisories@github.com","tags":["Product"],"url":"https://github.com/traccar/traccar/blob/v6.11.0/src/main/java/org/traccar/reports/GpxExportProvider.java#L52-L54"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-32pj-vrqc-x656"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-27694.json b/data/2026/CVE-2026-27694.json
index ad408a578f..550b5691f6 100644
--- a/data/2026/CVE-2026-27694.json
+++ b/data/2026/CVE-2026-27694.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"traccar","vendor":"traccar","versions":[{"status":"affected","version":">= 6.11.1, < 6.13.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*","matchCriteriaId":"A453268E-69E6-4CE2-A341-8890520DF28E","versionEndExcluding":"6.13.0","versionStartIncluding":"6.11.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0."}],"id":"CVE-2026-27694","lastModified":"2026-06-17T10:27:31.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-27694","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T13:58:18.200849Z","version":"2.0.3"}}]},"published":"2026-05-05T13:16:28.513","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"traccar","vendor":"traccar","versions":[{"status":"affected","version":">= 6.11.1, < 6.13.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traccar:traccar:*:*:*:*:*:*:*:*","matchCriteriaId":"A453268E-69E6-4CE2-A341-8890520DF28E","versionEndExcluding":"6.13.0","versionStartIncluding":"6.11.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the email notification templates insert user-controlled device, geofence, and driver names into HTML email output without proper escaping. An attacker with low privileges can store crafted HTML in these fields, which is then rendered in notification emails sent to other users with access to the affected devices. This can lead to phishing or spoofed email content. This issue is fixed in version 6.13.0."},{"lang":"es","value":"Traccar es un sistema de seguimiento GPS de código abierto. En las versiones de org.traccar:traccar a partir de la 6.11.1 y anteriores a la 6.13.0, las plantillas de notificación por correo electrónico insertan nombres de dispositivos, geocercas y conductores controlados por el usuario en la salida de correo electrónico HTML sin el escape adecuado. Un atacante con privilegios bajos puede almacenar HTML manipulado en estos campos, que luego se renderiza en los correos electrónicos de notificación enviados a otros usuarios con acceso a los dispositivos afectados. Esto puede llevar a phishing o contenido de correo electrónico falsificado. Este problema se solucionó en la versión 6.13.0."}],"id":"CVE-2026-27694","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-27694","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T13:58:18.200849Z","version":"2.0.3"}}]},"published":"2026-05-05T13:16:28.513","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/traccar/traccar/security/advisories/GHSA-6hfr-mj4m-hrvv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-28221.json b/data/2026/CVE-2026-28221.json
index 69f2546fa4..b4f66d55e3 100644
--- a/data/2026/CVE-2026-28221.json
+++ b/data/2026/CVE-2026-28221.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.8.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"DB572FD1-FC2F-4F4E-AEF4-2B03B1725B74","versionEndExcluding":"4.14.4","versionStartIncluding":"4.8.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists in print_hex_string() in wazuh-remoted. The bug is triggered when formatting attacker-controlled bytes using sprintf(dst_buf + 2*i, \"%.2x\", src_buf[i]) on platforms where char is treated as signed and the compiled code sign-extends bytes before the variadic call. For input bytes such as 0xFF, the formatting can emit \"ffffffff\" (8 chars) instead of \"ff\" (2 chars), causing an out-of-bounds write past a fixed 2049-byte stack buffer. The vulnerable path is reachable remotely prior to any agent authentication/registration logic via TCP/1514 when an oversized length prefix causes the “unexpected message (hex)” diagnostic path to run. Additionally, the same unauthenticated oversized-message diagnostic path logs an attacker-controlled hex dump to /var/ossec/logs/ossec.log for each trigger, allowing remote log amplification that can degrade monitoring fidelity and consume disk/I/O. This log amplification is reachable even without triggering the sign-extension overflow (e.g., using bytes < 0x80). This issue has been patched in version 4.14.4."}],"id":"CVE-2026-28221","lastModified":"2026-06-17T10:28:21.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28221","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:34:55.716001Z","version":"2.0.3"}}]},"published":"2026-04-29T19:16:23.047","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-q9vv-7w4c-f4cm"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-q9vv-7w4c-f4cm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-400"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.8.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"DB572FD1-FC2F-4F4E-AEF4-2B03B1725B74","versionEndExcluding":"4.14.4","versionStartIncluding":"4.8.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to before version 4.14.4, a stack-based buffer overflow exists in print_hex_string() in wazuh-remoted. The bug is triggered when formatting attacker-controlled bytes using sprintf(dst_buf + 2*i, \"%.2x\", src_buf[i]) on platforms where char is treated as signed and the compiled code sign-extends bytes before the variadic call. For input bytes such as 0xFF, the formatting can emit \"ffffffff\" (8 chars) instead of \"ff\" (2 chars), causing an out-of-bounds write past a fixed 2049-byte stack buffer. The vulnerable path is reachable remotely prior to any agent authentication/registration logic via TCP/1514 when an oversized length prefix causes the “unexpected message (hex)” diagnostic path to run. Additionally, the same unauthenticated oversized-message diagnostic path logs an attacker-controlled hex dump to /var/ossec/logs/ossec.log for each trigger, allowing remote log amplification that can degrade monitoring fidelity and consume disk/I/O. This log amplification is reachable even without triggering the sign-extension overflow (e.g., using bytes < 0x80). This issue has been patched in version 4.14.4."},{"lang":"es","value":"Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta a amenazas. Desde la versión 4.8.0 hasta antes de la versión 4.14.4, existe un desbordamiento de búfer basado en pila en print_hex_string() en wazuh-remoted. El error se activa al formatear bytes controlados por el atacante usando sprintf(dst_buf + 2i, ’%.2x’, src_buf[i]) en plataformas donde char se trata como con signo y el código compilado extiende el signo de los bytes antes de la llamada variádica. Para bytes de entrada como 0xFF, el formateo puede emitir ’ffffffff’ (8 caracteres) en lugar de ’ff’ (2 caracteres), causando una escritura fuera de límites más allá de un búfer de pila fijo de 2049 bytes. La ruta vulnerable es accesible de forma remota antes de cualquier lógica de autenticación/registro del agente a través de TCP/1514 cuando un prefijo de longitud excesiva hace que se ejecute la ruta de diagnóstico ’mensaje inesperado (hex)’. Además, la misma ruta de diagnóstico de mensaje excesivo no autenticado registra un volcado hexadecimal controlado por el atacante en /var/ossec/logs/ossec.log por cada activación, lo que permite la amplificación remota de registros que puede degradar la fidelidad del monitoreo y consumir disco/E/S. Esta amplificación de registros es accesible incluso sin activar el desbordamiento por extensión de signo (p. ej., usando bytes menor que 0x80). Este problema ha sido parcheado en la versión 4.14.4."}],"id":"CVE-2026-28221","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28221","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:34:55.716001Z","version":"2.0.3"}}]},"published":"2026-04-29T19:16:23.047","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-q9vv-7w4c-f4cm"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-q9vv-7w4c-f4cm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-400"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-28510.json b/data/2026/CVE-2026-28510.json
index ee8fbb8058..4829f670ad 100644
--- a/data/2026/CVE-2026-28510.json
+++ b/data/2026/CVE-2026-28510.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"elabftw","vendor":"elabftw","versions":[{"status":"affected","version":"= 5.4.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*","matchCriteriaId":"593B8947-A7C6-4FA6-8D3F-E6001CB0C8E5","versionEndExcluding":"5.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2."}],"id":"CVE-2026-28510","lastModified":"2026-06-17T10:28:46.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-06T14:14:06.434901Z","version":"2.0.3"}}]},"published":"2026-05-05T13:16:28.667","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/elabftw/elabftw/commit/8b7a575aef128870861187eaa2b2f0f08654ecf9"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/elabftw/elabftw/security/advisories/GHSA-x5wv-c9q4-fj65"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-302"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"elabftw","vendor":"elabftw","versions":[{"status":"affected","version":"= 5.4.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:elabftw:elabftw:*:*:*:*:*:*:*:*","matchCriteriaId":"593B8947-A7C6-4FA6-8D3F-E6001CB0C8E5","versionEndExcluding":"5.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2."},{"lang":"es","value":"eLabFTW es un cuaderno de laboratorio electrónico de código abierto. En las versiones de elabftw hasta la 5.4.1, el flujo de inicio de sesión no preservaba de forma fiable el estado de la autenticación multifactor a través de los pasos de autenticación. Bajo ciertas condiciones, un atacante con credenciales primarias válidas podría completar la autenticación con un secreto TOTP controlado por el atacante y omitir el factor adicional. Esto podría resultar en acceso no autorizado a la cuenta. Este problema está solucionado en la versión 5.4.2."}],"id":"CVE-2026-28510","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-06T14:14:06.434901Z","version":"2.0.3"}}]},"published":"2026-05-05T13:16:28.667","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/elabftw/elabftw/commit/8b7a575aef128870861187eaa2b2f0f08654ecf9"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/elabftw/elabftw/security/advisories/GHSA-x5wv-c9q4-fj65"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-302"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-30893.json b/data/2026/CVE-2026-30893.json
index 0df970cfc7..7454c05b54 100644
--- a/data/2026/CVE-2026-30893.json
+++ b/data/2026/CVE-2026-30893.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.4.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"CF4A0B6F-989A-47DB-BA1C-FC9F4D68A805","versionEndExcluding":"4.14.4","versionStartIncluding":"4.4.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept available as separate attachment). In deployments where the cluster daemon runs with elevated privileges, system-level compromise is possible. This issue has been patched in version 4.14.4."}],"id":"CVE-2026-30893","lastModified":"2026-06-17T10:33:06.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30893","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:29:05.312437Z","version":"2.0.3"}}]},"published":"2026-04-29T19:16:23.200","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.4.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"CF4A0B6F-989A-47DB-BA1C-FC9F4D68A805","versionEndExcluding":"4.14.4","versionStartIncluding":"4.4.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept available as separate attachment). In deployments where the cluster daemon runs with elevated privileges, system-level compromise is possible. This issue has been patched in version 4.14.4."},{"lang":"es","value":"Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta a amenazas. Desde la versión 4.4.0 hasta antes de la versión 4.14.4, una vulnerabilidad de salto de ruta en la rutina de extracción de sincronización de clúster de Wazuh permite a un par de clúster autenticado escribir archivos arbitrarios fuera del directorio de extracción previsto en otros nodos del clúster. Esto puede escalarse a ejecución de código en el contexto del servicio de Wazuh sobrescribiendo módulos de Python cargados por componentes de Wazuh (prueba de concepto disponible como archivo adjunto separado). En implementaciones donde el demonio del clúster se ejecuta con privilegios elevados, es posible el compromiso a nivel de sistema. Este problema ha sido parcheado en la versión 4.14.4."}],"id":"CVE-2026-30893","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30893","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:29:05.312437Z","version":"2.0.3"}}]},"published":"2026-04-29T19:16:23.200","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-m8rw-v4f6-8787"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31692.json b/data/2026/CVE-2026-31692.json
index eff73c5d12..f397e6a65d 100644
--- a/data/2026/CVE-2026-31692.json
+++ b/data/2026/CVE-2026-31692.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/rtnetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0975b64ffb34560042090a5986c3a02e6c80f36f","status":"affected","version":"81adee47dfb608df3ad0b91d230fb3cef75f0060","versionType":"git"},{"lessThan":"d04cc16d3624218a5458b2b664ae431f1b3b334d","status":"affected","version":"81adee47dfb608df3ad0b91d230fb3cef75f0060","versionType":"git"},{"lessThan":"7b735ef81286007794a227ce2539419479c02a5f","status":"affected","version":"81adee47dfb608df3ad0b91d230fb3cef75f0060","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/rtnetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EBA181D-17F3-49DD-851C-CB693F3EFF3D","versionEndExcluding":"6.18.24","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: add missing netlink_ns_capable() check for peer netns\n\nrtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer\nnetwork namespace when creating paired devices (veth, vxcan,\nnetkit). This allows an unprivileged user with a user namespace\nto create interfaces in arbitrary network namespaces, including\ninit_net.\n\nAdd a netlink_ns_capable() check for CAP_NET_ADMIN in the peer\nnamespace before allowing device creation to proceed."}],"id":"CVE-2026-31692","lastModified":"2026-11-06T16:18:08.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31692","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:27.396675Z","version":"2.0.3"}}]},"published":"2026-04-30T11:16:20.860","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0975b64ffb34560042090a5986c3a02e6c80f36f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d04cc16d3624218a5458b2b664ae431f1b3b334d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/rtnetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0975b64ffb34560042090a5986c3a02e6c80f36f","status":"affected","version":"81adee47dfb608df3ad0b91d230fb3cef75f0060","versionType":"git"},{"lessThan":"d04cc16d3624218a5458b2b664ae431f1b3b334d","status":"affected","version":"81adee47dfb608df3ad0b91d230fb3cef75f0060","versionType":"git"},{"lessThan":"7b735ef81286007794a227ce2539419479c02a5f","status":"affected","version":"81adee47dfb608df3ad0b91d230fb3cef75f0060","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/rtnetlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EBA181D-17F3-49DD-851C-CB693F3EFF3D","versionEndExcluding":"6.18.24","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtnetlink: add missing netlink_ns_capable() check for peer netns\n\nrtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer\nnetwork namespace when creating paired devices (veth, vxcan,\nnetkit). This allows an unprivileged user with a user namespace\nto create interfaces in arbitrary network namespaces, including\ninit_net.\n\nAdd a netlink_ns_capable() check for CAP_NET_ADMIN in the peer\nnamespace before allowing device creation to proceed."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrtnetlink: añadir la comprobación netlink_ns_capable() faltante para el netns par\n\nrtnl_newlink() carece de una comprobación de capacidad CAP_NET_ADMIN en el espacio de nombres de red par al crear dispositivos emparejados (veth, vxcan, netkit). Esto permite a un usuario sin privilegios con un espacio de nombres de usuario crear interfaces en espacios de nombres de red arbitrarios, incluyendo init_net.\n\nAñadir una comprobación netlink_ns_capable() para CAP_NET_ADMIN en el espacio de nombres par antes de permitir que proceda la creación del dispositivo."}],"id":"CVE-2026-31692","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31692","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:27.396675Z","version":"2.0.3"}}]},"published":"2026-04-30T11:16:20.860","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0975b64ffb34560042090a5986c3a02e6c80f36f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b735ef81286007794a227ce2539419479c02a5f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d04cc16d3624218a5458b2b664ae431f1b3b334d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31693.json b/data/2026/CVE-2026-31693.json
index 70ec7525c8..46292d32b9 100644
--- a/data/2026/CVE-2026-31693.json
+++ b/data/2026/CVE-2026-31693.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c","fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c854ab481ece4b3e5f4c2e8b22824f015ff874a5","status":"affected","version":"433042a91f9373241307725b52de573933ffedbf","versionType":"git"},{"lessThan":"1d731e512134495e0ef490ade0e4d91dc0d515ec","status":"affected","version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","versionType":"git"},{"lessThan":"7c9ce68192eef14c777cb6ce17155d2eb2431aea","status":"affected","version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","versionType":"git"},{"lessThan":"c99e160938b627f6f28edee930e8abc157e84386","status":"affected","version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","versionType":"git"},{"lessThan":"14f66f44646333d2bfd7ece36585874fd72f8286","status":"affected","version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","versionType":"git"},{"lessThan":"6.6.128","status":"affected","version":"6.6.32","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c","fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1ACC9D83-6159-4283-ABFF-6CB26A4C186A","versionEndExcluding":"6.6.128","versionStartIncluding":"6.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2A2F9210-271A-411D-8364-CAF6CDDEC6C0","versionEndExcluding":"6.12.75","versionStartIncluding":"6.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*","matchCriteriaId":"41E47F32-BA80-4333-96FD-4D25082B0FDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*","matchCriteriaId":"056BD938-0A27-4569-B391-30578B309EE3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*","matchCriteriaId":"F02056A5-B362-4370-9FF8-6F0BD384D520","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*","matchCriteriaId":"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*","matchCriteriaId":"A780F817-2A77-4130-A9B7-5C25606314E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*","matchCriteriaId":"AEB9199B-AB8F-4877-8964-E2BA95B5F15C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*","matchCriteriaId":"C9B8A5CE-6D20-4C36-AC01-ACA4B70003A8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: some missing initializations on replay\n\nIn several places in the code, we have a label to signify\nthe start of the code where a request can be replayed if\nnecessary. However, some of these places were missing the\nnecessary reinitializations of certain local variables\nbefore replay.\n\nThis change makes sure that these variables get initialized\nafter the label."}],"id":"CVE-2026-31693","lastModified":"2026-10-19T19:18:06.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:31.622754Z","version":"2.0.3"}}]},"published":"2026-04-30T12:16:24.103","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14f66f44646333d2bfd7ece36585874fd72f8286"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d731e512134495e0ef490ade0e4d91dc0d515ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7c9ce68192eef14c777cb6ce17155d2eb2431aea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c854ab481ece4b3e5f4c2e8b22824f015ff874a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c99e160938b627f6f28edee930e8abc157e84386"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-665"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c","fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c854ab481ece4b3e5f4c2e8b22824f015ff874a5","status":"affected","version":"433042a91f9373241307725b52de573933ffedbf","versionType":"git"},{"lessThan":"1d731e512134495e0ef490ade0e4d91dc0d515ec","status":"affected","version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","versionType":"git"},{"lessThan":"7c9ce68192eef14c777cb6ce17155d2eb2431aea","status":"affected","version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","versionType":"git"},{"lessThan":"c99e160938b627f6f28edee930e8abc157e84386","status":"affected","version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","versionType":"git"},{"lessThan":"14f66f44646333d2bfd7ece36585874fd72f8286","status":"affected","version":"4f1fffa2376922f3d1d506e49c0fd445b023a28e","versionType":"git"},{"lessThan":"6.6.128","status":"affected","version":"6.6.32","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c","fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1ACC9D83-6159-4283-ABFF-6CB26A4C186A","versionEndExcluding":"6.6.128","versionStartIncluding":"6.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2A2F9210-271A-411D-8364-CAF6CDDEC6C0","versionEndExcluding":"6.12.75","versionStartIncluding":"6.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*","matchCriteriaId":"41E47F32-BA80-4333-96FD-4D25082B0FDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*","matchCriteriaId":"056BD938-0A27-4569-B391-30578B309EE3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*","matchCriteriaId":"F02056A5-B362-4370-9FF8-6F0BD384D520","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*","matchCriteriaId":"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*","matchCriteriaId":"A780F817-2A77-4130-A9B7-5C25606314E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*","matchCriteriaId":"AEB9199B-AB8F-4877-8964-E2BA95B5F15C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*","matchCriteriaId":"C9B8A5CE-6D20-4C36-AC01-ACA4B70003A8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: some missing initializations on replay\n\nIn several places in the code, we have a label to signify\nthe start of the code where a request can be replayed if\nnecessary. However, some of these places were missing the\nnecessary reinitializations of certain local variables\nbefore replay.\n\nThis change makes sure that these variables get initialized\nafter the label."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncifs: algunas inicializaciones faltantes en la repetición\n\nEn varios lugares del código, tenemos una etiqueta para indicar el inicio del código donde una solicitud puede ser reejecutada si es necesario. Sin embargo, algunos de estos lugares carecían de las reinicializaciones necesarias de ciertas variables locales antes de la reejecución.\n\nEste cambio asegura que estas variables se inicialicen después de la etiqueta."}],"id":"CVE-2026-31693","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:31.622754Z","version":"2.0.3"}}]},"published":"2026-04-30T12:16:24.103","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14f66f44646333d2bfd7ece36585874fd72f8286"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d731e512134495e0ef490ade0e4d91dc0d515ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7c9ce68192eef14c777cb6ce17155d2eb2431aea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c854ab481ece4b3e5f4c2e8b22824f015ff874a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c99e160938b627f6f28edee930e8abc157e84386"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-665"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31694.json b/data/2026/CVE-2026-31694.json
index 15327dbde4..b0cc632088 100644
--- a/data/2026/CVE-2026-31694.json
+++ b/data/2026/CVE-2026-31694.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/fuse/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7de93abfaae1b2dc94da8a07a36421bd073f1d8f","status":"affected","version":"27992ef80770d61a57f6c3a551735b08cefdffa3","versionType":"git"},{"lessThan":"474ce83c96a55f2eeb14dee2be375eeadfdacdf5","status":"affected","version":"27992ef80770d61a57f6c3a551735b08cefdffa3","versionType":"git"},{"lessThan":"51a8de6c50bf947c8f534cd73da4c8f0a13e7bed","status":"affected","version":"27992ef80770d61a57f6c3a551735b08cefdffa3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/fuse/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F2D3B79E-3EFA-4203-9F11-FF77FD2FBA79","versionEndExcluding":"6.18.25","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6C0262-1527-4F55-8BDE-973F59FE7E1B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"754051AB-27D3-41CA-B2C8-79BAD48C8750","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache."}],"id":"CVE-2026-31694","lastModified":"2026-10-23T14:06:26.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:19.133","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/474ce83c96a55f2eeb14dee2be375eeadfdacdf5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51a8de6c50bf947c8f534cd73da4c8f0a13e7bed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7de93abfaae1b2dc94da8a07a36421bd073f1d8f"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/fuse/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7de93abfaae1b2dc94da8a07a36421bd073f1d8f","status":"affected","version":"27992ef80770d61a57f6c3a551735b08cefdffa3","versionType":"git"},{"lessThan":"474ce83c96a55f2eeb14dee2be375eeadfdacdf5","status":"affected","version":"27992ef80770d61a57f6c3a551735b08cefdffa3","versionType":"git"},{"lessThan":"51a8de6c50bf947c8f534cd73da4c8f0a13e7bed","status":"affected","version":"27992ef80770d61a57f6c3a551735b08cefdffa3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/fuse/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F2D3B79E-3EFA-4203-9F11-FF77FD2FBA79","versionEndExcluding":"6.18.25","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6C0262-1527-4F55-8BDE-973F59FE7E1B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"754051AB-27D3-41CA-B2C8-79BAD48C8750","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject oversized dirents in page cache\n\nfuse_add_dirent_to_cache() computes a serialized dirent size from the\nserver-controlled namelen field and copies the dirent into a single\npage-cache page. The existing logic only checks whether the dirent fits\nin the remaining space of the current page and advances to a fresh page\nif not. It never checks whether the dirent itself exceeds PAGE_SIZE.\n\nAs a result, a malicious FUSE server can return a dirent with\nnamelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB\npage systems this causes memcpy() to overflow the cache page by 24 bytes\ninto the following kernel page.\n\nReject dirents that cannot fit in a single page before copying them into\nthe readdir cache."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfuse: rechazar entradas de directorio de tamaño excesivo en la caché de páginas\n\nfuse_add_dirent_to_cache() calcula un tamaño de entrada de directorio serializado a partir del campo ’namelen’ controlado por el servidor y copia la entrada de directorio en una única página de la caché de páginas. La lógica existente solo verifica si la entrada de directorio cabe en el espacio restante de la página actual y avanza a una página nueva si no es así. Nunca verifica si la propia entrada de directorio excede PAGE_SIZE.\n\nComo resultado, un servidor FUSE malicioso puede devolver una entrada de directorio con namelen=4095, produciendo un tamaño de registro serializado de 4120 bytes. En sistemas con páginas de 4 KiB, esto provoca que memcpy() desborde la página de caché en 24 bytes hacia la siguiente página del kernel.\n\nRechazar entradas de directorio que no pueden caber en una sola página antes de copiarlas en la caché de readdir."}],"id":"CVE-2026-31694","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:19.133","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/474ce83c96a55f2eeb14dee2be375eeadfdacdf5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51a8de6c50bf947c8f534cd73da4c8f0a13e7bed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7de93abfaae1b2dc94da8a07a36421bd073f1d8f"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31695.json b/data/2026/CVE-2026-31695.json
index a50e3daa0f..450b1f5b92 100644
--- a/data/2026/CVE-2026-31695.json
+++ b/data/2026/CVE-2026-31695.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/virtual/virt_wifi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e90f3e74e1ebc26c461a74be490d322716bcdcb4","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"dcb5915696bd7b32b6404a897c24ee47cb23e772","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"d1e3aa80e6e04410ba89eaaba4441a0d749d181d","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"c5fa98842783ed227365d1303785de6a67020c8d","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"5bbadf60b121065ffb267ec92018607b9c1c7524","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"5adc01506da94dfaab76f3d1b8410a8ca7bfc59d","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"789b06f9f39cdc7e895bdab2c034e39c41c8f8d6","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/virtual/virt_wifi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85C0DA29-FD98-4182-B0A1-624E28976709","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free\n\nCurrently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for\nthe virt_wifi net devices. However, unregistering a virt_wifi device in\nnetdev_run_todo() can happen together with the device referenced by\nSET_NETDEV_DEV().\n\nIt can result in use-after-free during the ethtool operations performed\non a virt_wifi device that is currently being unregistered. Such a net\ndevice can have the `dev.parent` field pointing to the freed memory,\nbut ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.\n\nLet's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0\n Read of size 2 at addr ffff88810cfc46f8 by task pm/606\n\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x4d/0x70\n  print_report+0x170/0x4f3\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  kasan_report+0xda/0x110\n  ? __pm_runtime_resume+0xe2/0xf0\n  ? __pm_runtime_resume+0xe2/0xf0\n  __pm_runtime_resume+0xe2/0xf0\n  ethnl_ops_begin+0x49/0x270\n  ethnl_set_features+0x23c/0xab0\n  ? __pfx_ethnl_set_features+0x10/0x10\n  ? kvm_sched_clock_read+0x11/0x20\n  ? local_clock_noinstr+0xf/0xf0\n  ? local_clock+0x10/0x30\n  ? kasan_save_track+0x25/0x60\n  ? __kasan_kmalloc+0x7f/0x90\n  ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0\n  genl_family_rcv_msg_doit+0x1e7/0x2c0\n  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10\n  ? __pfx_cred_has_capability.isra.0+0x10/0x10\n  ? stack_trace_save+0x8e/0xc0\n  genl_rcv_msg+0x411/0x660\n  ? __pfx_genl_rcv_msg+0x10/0x10\n  ? __pfx_ethnl_set_features+0x10/0x10\n  netlink_rcv_skb+0x121/0x380\n  ? __pfx_genl_rcv_msg+0x10/0x10\n  ? __pfx_netlink_rcv_skb+0x10/0x10\n  ? __pfx_down_read+0x10/0x10\n  genl_rcv+0x23/0x30\n  netlink_unicast+0x60f/0x830\n  ? __pfx_netlink_unicast+0x10/0x10\n  ? __pfx___alloc_skb+0x10/0x10\n  netlink_sendmsg+0x6ea/0xbc0\n  ? __pfx_netlink_sendmsg+0x10/0x10\n  ? __futex_queue+0x10b/0x1f0\n  ____sys_sendmsg+0x7a2/0x950\n  ? copy_msghdr_from_user+0x26b/0x430\n  ? __pfx_____sys_sendmsg+0x10/0x10\n  ? __pfx_copy_msghdr_from_user+0x10/0x10\n  ___sys_sendmsg+0xf8/0x180\n  ? __pfx____sys_sendmsg+0x10/0x10\n  ? __pfx_futex_wait+0x10/0x10\n  ? fdget+0x2e4/0x4a0\n  __sys_sendmsg+0x11f/0x1c0\n  ? __pfx___sys_sendmsg+0x10/0x10\n  do_syscall_64+0xe2/0x570\n  ? exc_page_fault+0x66/0xb0\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  </TASK>\n\nThis fix may be combined with another one in the ethtool subsystem:\nhttps://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u"}],"id":"CVE-2026-31695","lastModified":"2026-06-17T10:34:15.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:19.250","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5adc01506da94dfaab76f3d1b8410a8ca7bfc59d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5bbadf60b121065ffb267ec92018607b9c1c7524"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c5fa98842783ed227365d1303785de6a67020c8d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1e3aa80e6e04410ba89eaaba4441a0d749d181d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dcb5915696bd7b32b6404a897c24ee47cb23e772"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e90f3e74e1ebc26c461a74be490d322716bcdcb4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/virtual/virt_wifi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e90f3e74e1ebc26c461a74be490d322716bcdcb4","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"dcb5915696bd7b32b6404a897c24ee47cb23e772","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"d1e3aa80e6e04410ba89eaaba4441a0d749d181d","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"c5fa98842783ed227365d1303785de6a67020c8d","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"5bbadf60b121065ffb267ec92018607b9c1c7524","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"5adc01506da94dfaab76f3d1b8410a8ca7bfc59d","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"},{"lessThan":"789b06f9f39cdc7e895bdab2c034e39c41c8f8d6","status":"affected","version":"d43c65b05b848e0b2db1a6c78b02c189da3a95b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/virtual/virt_wifi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85C0DA29-FD98-4182-B0A1-624E28976709","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free\n\nCurrently we execute `SET_NETDEV_DEV(dev, &priv->lowerdev->dev)` for\nthe virt_wifi net devices. However, unregistering a virt_wifi device in\nnetdev_run_todo() can happen together with the device referenced by\nSET_NETDEV_DEV().\n\nIt can result in use-after-free during the ethtool operations performed\non a virt_wifi device that is currently being unregistered. Such a net\ndevice can have the `dev.parent` field pointing to the freed memory,\nbut ethnl_ops_begin() calls `pm_runtime_get_sync(dev->dev.parent)`.\n\nLet's remove SET_NETDEV_DEV for virt_wifi to avoid bugs like this:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in __pm_runtime_resume+0xe2/0xf0\n Read of size 2 at addr ffff88810cfc46f8 by task pm/606\n\n Call Trace:\n  <TASK>\n  dump_stack_lvl+0x4d/0x70\n  print_report+0x170/0x4f3\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  kasan_report+0xda/0x110\n  ? __pm_runtime_resume+0xe2/0xf0\n  ? __pm_runtime_resume+0xe2/0xf0\n  __pm_runtime_resume+0xe2/0xf0\n  ethnl_ops_begin+0x49/0x270\n  ethnl_set_features+0x23c/0xab0\n  ? __pfx_ethnl_set_features+0x10/0x10\n  ? kvm_sched_clock_read+0x11/0x20\n  ? local_clock_noinstr+0xf/0xf0\n  ? local_clock+0x10/0x30\n  ? kasan_save_track+0x25/0x60\n  ? __kasan_kmalloc+0x7f/0x90\n  ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0\n  genl_family_rcv_msg_doit+0x1e7/0x2c0\n  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10\n  ? __pfx_cred_has_capability.isra.0+0x10/0x10\n  ? stack_trace_save+0x8e/0xc0\n  genl_rcv_msg+0x411/0x660\n  ? __pfx_genl_rcv_msg+0x10/0x10\n  ? __pfx_ethnl_set_features+0x10/0x10\n  netlink_rcv_skb+0x121/0x380\n  ? __pfx_genl_rcv_msg+0x10/0x10\n  ? __pfx_netlink_rcv_skb+0x10/0x10\n  ? __pfx_down_read+0x10/0x10\n  genl_rcv+0x23/0x30\n  netlink_unicast+0x60f/0x830\n  ? __pfx_netlink_unicast+0x10/0x10\n  ? __pfx___alloc_skb+0x10/0x10\n  netlink_sendmsg+0x6ea/0xbc0\n  ? __pfx_netlink_sendmsg+0x10/0x10\n  ? __futex_queue+0x10b/0x1f0\n  ____sys_sendmsg+0x7a2/0x950\n  ? copy_msghdr_from_user+0x26b/0x430\n  ? __pfx_____sys_sendmsg+0x10/0x10\n  ? __pfx_copy_msghdr_from_user+0x10/0x10\n  ___sys_sendmsg+0xf8/0x180\n  ? __pfx____sys_sendmsg+0x10/0x10\n  ? __pfx_futex_wait+0x10/0x10\n  ? fdget+0x2e4/0x4a0\n  __sys_sendmsg+0x11f/0x1c0\n  ? __pfx___sys_sendmsg+0x10/0x10\n  do_syscall_64+0xe2/0x570\n  ? exc_page_fault+0x66/0xb0\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  </TASK>\n\nThis fix may be combined with another one in the ethtool subsystem:\nhttps://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: virt_wifi: eliminar SET_NETDEV_DEV para evitar el uso después de liberación\n\nActualmente ejecutamos ’SET_NETDEV_DEV(dev, &priv  ->  lowerdev  ->  dev)’ para los dispositivos de red virt_wifi. Sin embargo, el desregistro de un dispositivo virt_wifi en netdev_run_todo() puede ocurrir junto con el dispositivo referenciado por SET_NETDEV_DEV().\n\nPuede resultar en un uso después de liberación durante las operaciones de ethtool realizadas en un dispositivo virt_wifi que está siendo desregistrado actualmente. Dicho dispositivo de red puede tener el campo ’dev.parent’ apuntando a la memoria liberada, pero ethnl_ops_begin() llama a ’pm_runtime_get_sync(dev  ->  dev.parent)’.\n\nEliminemos SET_NETDEV_DEV para virt_wifi para evitar errores como este:\n\n ==================================================================\n BUG: KASAN: uso después de liberación de slab en __pm_runtime_resume+0xe2/0xf0\n Lectura de tamaño 2 en la dirección ffff88810cfc46f8 por la tarea pm/606\n\n Traza de Llamada:\n  [TASK]\n  dump_stack_lvl+0x4d/0x70\n  print_report+0x170/0x4f3\n  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  kasan_report+0xda/0x110\n  ? __pm_runtime_resume+0xe2/0xf0\n  ? __pm_runtime_resume+0xe2/0xf0\n  __pm_runtime_resume+0xe2/0xf0\n  ethnl_ops_begin+0x49/0x270\n  ethnl_set_features+0x23c/0xab0\n  ? __pfx_ethnl_set_features+0x10/0x10\n  ? kvm_sched_clock_read+0x11/0x20\n  ? local_clock_noinstr+0xf/0xf0\n  ? local_clock+0x10/0x30\n  ? kasan_save_track+0x25/0x60\n  ? __kasan_kmalloc+0x7f/0x90\n  ? genl_family_rcv_msg_attrs_parse.isra.0+0x150/0x2c0\n  genl_family_rcv_msg_doit+0x1e7/0x2c0\n  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10\n  ? __pfx_cred_has_capability.isra.0+0x10/0x10\n  ? stack_trace_save+0x8e/0xc0\n  genl_rcv_msg+0x411/0x660\n  ? __pfx_genl_rcv_msg+0x10/0x10\n  ? __pfx_ethnl_set_features+0x10/0x10\n  netlink_rcv_skb+0x121/0x380\n  ? __pfx_genl_rcv_msg+0x10/0x10\n  ? __pfx_netlink_rcv_skb+0x10/0x10\n  ? __pfx_down_read+0x10/0x10\n  genl_rcv+0x23/0x30\n  netlink_unicast+0x60f/0x830\n  ? __pfx_netlink_unicast+0x10/0x10\n  ? __pfx___alloc_skb+0x10/0x10\n  netlink_sendmsg+0x6ea/0xbc0\n  ? __pfx_netlink_sendmsg+0x10/0x10\n  ? __futex_queue+0x10b/0x1f0\n  ____sys_sendmsg+0x7a2/0x950\n  ? copy_msghdr_from_user+0x26b/0x430\n  ? __pfx_____sys_sendmsg+0x10/0x10\n  ? __pfx_copy_msghdr_from_user+0x10/0x10\n  ___sys_sendmsg+0xf8/0x180\n  ? __pfx____sys_sendmsg+0x10/0x10\n  ? __pfx_futex_wait+0x10/0x10\n  ? fdget+0x2e4/0x4a0\n  __sys_sendmsg+0x11f/0x1c0\n  ? __pfx___sys_sendmsg+0x10/0x10\n  do_syscall_64+0xe2/0x570\n  ? exc_page_fault+0x66/0xb0\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  [/TASK]\n\nEsta corrección puede combinarse con otra en el subsistema ethtool:\nhttps://lore.kernel.org/all/20260322075917.254874-1-alex.popov@linux.com/T/#u"}],"id":"CVE-2026-31695","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:19.250","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5adc01506da94dfaab76f3d1b8410a8ca7bfc59d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5bbadf60b121065ffb267ec92018607b9c1c7524"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/789b06f9f39cdc7e895bdab2c034e39c41c8f8d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c5fa98842783ed227365d1303785de6a67020c8d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1e3aa80e6e04410ba89eaaba4441a0d749d181d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dcb5915696bd7b32b6404a897c24ee47cb23e772"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e90f3e74e1ebc26c461a74be490d322716bcdcb4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31696.json b/data/2026/CVE-2026-31696.json
index bf618a9d09..0210c23761 100644
--- a/data/2026/CVE-2026-31696.json
+++ b/data/2026/CVE-2026-31696.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"44714dfda386884919ba366411880b6fb3c3efd3","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"41a117dd80371343babc52198d1114e83eb37627","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"9a397aa9b5e53ca63d4d6aefb542832eca389618","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"1fa36cf495b0023e8475d038535c05e4063211e1","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"4458757c020592a3094366e0fb20457383b42f92","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"ce383ba615339f8eaec646a166d2c2b015bb5ca0","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"a1be1c9ece26cea69654f28b255ff9a7906b897b","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"ac33733b10b484d666f97688561670afd5861383","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C73D2808-65F0-4CE5-A194-0FCDE4D23BFC","versionEndExcluding":"6.6.136","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads <= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic."}],"id":"CVE-2026-31696","lastModified":"2026-11-06T16:18:08.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:31.625988Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.403","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"44714dfda386884919ba366411880b6fb3c3efd3","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"41a117dd80371343babc52198d1114e83eb37627","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"9a397aa9b5e53ca63d4d6aefb542832eca389618","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"1fa36cf495b0023e8475d038535c05e4063211e1","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"4458757c020592a3094366e0fb20457383b42f92","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"ce383ba615339f8eaec646a166d2c2b015bb5ca0","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"a1be1c9ece26cea69654f28b255ff9a7906b897b","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"},{"lessThan":"ac33733b10b484d666f97688561670afd5861383","status":"affected","version":"8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C73D2808-65F0-4CE5-A194-0FCDE4D23BFC","versionEndExcluding":"6.6.136","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads <= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Arreglo de la validación faltante de la longitud del ticket en el preanálisis de claves no-XDR\n\nEn rxrpc_preparse(), hay dos rutas para analizar cargas útiles de claves: la ruta XDR (para cargas útiles grandes) y la ruta no-XDR (para cargas útiles menor o igual que 28 bytes). Mientras que la ruta XDR (rxrpc_preparse_xdr_rxkad()) valida correctamente la longitud del ticket contra AFSTOKEN_RK_TIX_MAX, la ruta no-XDR falla en hacerlo.\n\nEsto permite a un usuario no privilegiado proporcionar una longitud de ticket muy grande. Cuando esta clave es leída posteriormente a través de rxrpc_read(), el cálculo del tamaño total del token (toksize) resulta en un valor que excede AFSTOKEN_LENGTH_MAX, desencadenando un WARN_ON().\n\n[ 2001.302904] ADVERTENCIA: CPU: 2 PID: 2108 en net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nSolucione esto añadiendo una verificación en la ruta de análisis no-XDR de rxrpc_preparse() para asegurar que la longitud del ticket no exceda AFSTOKEN_RK_TIX_MAX, poniéndolo a la par con la lógica de análisis XDR."}],"id":"CVE-2026-31696","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:31.625988Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.403","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31697.json b/data/2026/CVE-2026-31697.json
index b85f86f4ae..7f91df1aa6 100644
--- a/data/2026/CVE-2026-31697.json
+++ b/data/2026/CVE-2026-31697.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"a21ae9f8769e5f75433bb0a85ac3868b2100ef5b","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"09427bcb1715fb20a80b6acd5156dbf15ab5c363","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"1fbac0429a42adec830491757a2b53956dd797ea","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"06f06d88c05ce176c61fff8c72c372847b0dd2b5","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"4f685dbfa87c546e51d9dc6cab379d20f275e114","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C61C6D64-BBED-49D1-A334-68BA14CE5327","versionEndExcluding":"6.6.136","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy ID to userspace if PSP command failed\n\nWhen retrieving the ID for the CPU, don't attempt to copy the ID blob to\nuserspace if the firmware command failed.  If the failure was due to an\ninvalid length, i.e. the userspace buffer+length was too small, copying\nthe number of bytes _firmware_ requires will overflow the kernel-allocated\nbuffer and leak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388\n\n  CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222\n   sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}],"id":"CVE-2026-31697","lastModified":"2026-10-19T19:18:07.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:34.967225Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.517","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/06f06d88c05ce176c61fff8c72c372847b0dd2b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09427bcb1715fb20a80b6acd5156dbf15ab5c363"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1fbac0429a42adec830491757a2b53956dd797ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f685dbfa87c546e51d9dc6cab379d20f275e114"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a21ae9f8769e5f75433bb0a85ac3868b2100ef5b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"a21ae9f8769e5f75433bb0a85ac3868b2100ef5b","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"09427bcb1715fb20a80b6acd5156dbf15ab5c363","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"1fbac0429a42adec830491757a2b53956dd797ea","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"06f06d88c05ce176c61fff8c72c372847b0dd2b5","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"},{"lessThan":"4f685dbfa87c546e51d9dc6cab379d20f275e114","status":"affected","version":"d6112ea0cb344d6f5ed519991e24f69ba4b43d0e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C61C6D64-BBED-49D1-A334-68BA14CE5327","versionEndExcluding":"6.6.136","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy ID to userspace if PSP command failed\n\nWhen retrieving the ID for the CPU, don't attempt to copy the ID blob to\nuserspace if the firmware command failed.  If the failure was due to an\ninvalid length, i.e. the userspace buffer+length was too small, copying\nthe number of bytes _firmware_ requires will overflow the kernel-allocated\nbuffer and leak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 64 at addr ffff8881867f5960 by task syz.0.906/24388\n\n  CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_get_id2+0x361/0x490 ../drivers/crypto/ccp/sev-dev.c:2222\n   sev_ioctl+0x25f/0x490 ../drivers/crypto/ccp/sev-dev.c:2575\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: ccp: No intente copiar la ID al espacio de usuario si el comando PSP falló\n\nAl recuperar la ID para la CPU, no intente copiar el blob de ID al espacio de usuario si el comando del firmware falló. Si el fallo se debió a una longitud inválida, es decir, el búfer+longitud del espacio de usuario era demasiado pequeño, copiar el número de bytes que el firmware requiere desbordará el búfer asignado por el kernel y filtrará datos al espacio de usuario.\n\n  ERROR: KASAN: desbordamiento de slab en instrument_copy_to_user .. / include/linux/instrumented.h:129 [en línea]\n  ERROR: KASAN: desbordamiento de slab en _inline_copy_to_user .. / include/linux/uaccess.h:205 [en línea]\n  ERROR: KASAN: desbordamiento de slab en _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n  Lectura de tamaño 64 en la dirección ffff8881867f5960 por la tarea syz.0.906/24388\n\n  CPU: 130 UID: 0 PID: 24388 Comm: syz.0.906 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Nombre del hardware: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Traza de llamada:\n   [TAREA]\n   dump_stack_lvl+0xc5/0x110 .. / lib/dump_stack.c:120\n   print_address_description .. / mm/kasan/report.c:378 [en línea]\n   print_report+0xbc/0x260 .. / mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 .. / mm/kasan/report.c:595\n   check_region_inline .. / mm/kasan/generic.c:-1 [en línea]\n   kasan_check_range+0x264/0x2c0 .. / mm/kasan/generic.c:200\n   instrument_copy_to_user .. / include/linux/instrumented.h:129 [en línea]\n   _inline_copy_to_user .. / include/linux/uaccess.h:205 [en línea]\n   _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n   copy_to_user .. / include/linux/uaccess.h:236 [en línea]\n   sev_ioctl_do_get_id2+0x361/0x490 .. / drivers/crypto/ccp/sev-dev.c:2222\n   sev_ioctl+0x25f/0x490 .. / drivers/crypto/ccp/sev-dev.c:2575\n   vfs_ioctl .. / fs/ioctl.c:51 [en línea]\n   __do_sys_ioctl .. / fs/ioctl.c:597 [en línea]\n   __se_sys_ioctl+0x11d/0x1b0 .. / fs/ioctl.c:583\n   do_syscall_x64 .. / arch/x86/entry/syscall_64.c:63 [en línea]\n   do_syscall_64+0xe0/0x800 .. / arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   [/TAREA]\n\nADVERTENCIA si el controlador dice que el comando tuvo éxito, pero el código de error del firmware dice lo contrario, ya que se espera que __sev_do_cmd_locked() devuelva -EIO ante cualquier error del firmware."}],"id":"CVE-2026-31697","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31697","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:34.967225Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.517","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/06f06d88c05ce176c61fff8c72c372847b0dd2b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09427bcb1715fb20a80b6acd5156dbf15ab5c363"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f1f2f9894893dc8a28af1b9e9dbc0abf453eb52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1fbac0429a42adec830491757a2b53956dd797ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2937f17bbeefb8e7608ff1f78cffbeb3d0281e5e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f685dbfa87c546e51d9dc6cab379d20f275e114"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/99bae2e3c3f9ba8f854c938ed2c811b6a63b28e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a21ae9f8769e5f75433bb0a85ac3868b2100ef5b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31698.json b/data/2026/CVE-2026-31698.json
index d107656ab0..39c282dbac 100644
--- a/data/2026/CVE-2026-31698.json
+++ b/data/2026/CVE-2026-31698.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"af67d35da744b6b678c7a0296d9c679658779829","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"854d7846e1d29f32f1bbeb2e869e794df12067f6","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"25d9b3446001185484209cf57951f3368462b631","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"b5c14bd4da1f376f385722fe1da993f1edab6472","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"051e51aa55fd4cdc3e8283cf4476aeeb5f563274","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"50808c13452dae43a2c90b1bbbf9daa16501ce70","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"e76239fed3cffd6d304d8ca3ce23984fd24f57d3","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A32447F-A6C2-4D97-8B3B-EB4280574173","versionEndExcluding":"6.6.136","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed\n\nWhen retrieving the PDH cert, don't attempt to copy the blobs to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033\n\n  CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc.                                                       Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347\n   sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}],"id":"CVE-2026-31698","lastModified":"2026-10-19T20:17:56.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31698","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:37.237347Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.650","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/051e51aa55fd4cdc3e8283cf4476aeeb5f563274"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/25d9b3446001185484209cf57951f3368462b631"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/50808c13452dae43a2c90b1bbbf9daa16501ce70"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/854d7846e1d29f32f1bbeb2e869e794df12067f6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/af67d35da744b6b678c7a0296d9c679658779829"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5c14bd4da1f376f385722fe1da993f1edab6472"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e76239fed3cffd6d304d8ca3ce23984fd24f57d3"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"af67d35da744b6b678c7a0296d9c679658779829","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"854d7846e1d29f32f1bbeb2e869e794df12067f6","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"25d9b3446001185484209cf57951f3368462b631","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"b5c14bd4da1f376f385722fe1da993f1edab6472","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"051e51aa55fd4cdc3e8283cf4476aeeb5f563274","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"50808c13452dae43a2c90b1bbbf9daa16501ce70","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"},{"lessThan":"e76239fed3cffd6d304d8ca3ce23984fd24f57d3","status":"affected","version":"76a2b524a4b1d6dc0f2421f9854a01d55d5e5436","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A32447F-A6C2-4D97-8B3B-EB4280574173","versionEndExcluding":"6.6.136","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed\n\nWhen retrieving the PDH cert, don't attempt to copy the blobs to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff8885c4ab8aa0 by task syz.0.186/21033\n\n  CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc.                                                       Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pdh_export+0x3d3/0x7c0 ../drivers/crypto/ccp/sev-dev.c:2347\n   sev_ioctl+0x2a2/0x490 ../drivers/crypto/ccp/sev-dev.c:2568\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: ccp: No intente copiar el certificado PDH al espacio de usuario si el comando PSP falló\n\nAl recuperar el certificado PDH, no intente copiar los blobs al espacio de usuario si el comando del firmware falló. Si el fallo se debió a una longitud no válida, es decir, el búfer+longitud del espacio de usuario era demasiado pequeño, copiar el número de bytes que el _firmware_ requiere desbordará el búfer asignado por el kernel y filtrará datos al espacio de usuario.\n\n  BUG: KASAN: slab-out-of-bounds en instrument_copy_to_user .. / include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds en _inline_copy_to_user .. / include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds en _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n  Lectura de tamaño 2084 en la dirección ffff8885c4ab8aa0 por la tarea syz.0.186/21033\n\n  CPU: 51 UID: 0 PID: 21033 Comm: syz.0.186 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Nombre del hardware: Google, Inc.                                                       Arcadia_IT_80/Arcadia_IT_80, BIOS 34.84.12-0 11/17/2025\n  Traza de llamadas:\n   [TAREA]\n   dump_stack_lvl+0xc5/0x110 .. / lib/dump_stack.c:120\n   print_address_description .. / mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 .. / mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 .. / mm/kasan/report.c:595\n   check_region_inline .. / mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 .. / mm/kasan/generic.c:200\n   instrument_copy_to_user .. / include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user .. / include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n   copy_to_user .. / include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pdh_export+0x3d3/0x7c0 .. / drivers/crypto/ccp/sev-dev.c:2347\n   sev_ioctl+0x2a2/0x490 .. / drivers/crypto/ccp/sev-dev.c:2568\n   vfs_ioctl .. / fs/ioctl.c:51 [inline]\n   __do_sys_ioctl .. / fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 .. / fs/ioctl.c:583\n   do_syscall_x64 .. / arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 .. / arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   [/TAREA]\n\nADVERTENCIA si el controlador dice que el comando tuvo éxito, pero el código de error del firmware dice lo contrario, ya que se espera que __sev_do_cmd_locked() devuelva -EIO ante cualquier error del firmware."}],"id":"CVE-2026-31698","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31698","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:37.237347Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.650","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/051e51aa55fd4cdc3e8283cf4476aeeb5f563274"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/25d9b3446001185484209cf57951f3368462b631"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/50808c13452dae43a2c90b1bbbf9daa16501ce70"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78b97e43d0b3e674d9d49ae56937b11e2ba3fcaf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/854d7846e1d29f32f1bbeb2e869e794df12067f6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/af67d35da744b6b678c7a0296d9c679658779829"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5c14bd4da1f376f385722fe1da993f1edab6472"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e76239fed3cffd6d304d8ca3ce23984fd24f57d3"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31699.json b/data/2026/CVE-2026-31699.json
index 912bab6fe2..85cca4bd96 100644
--- a/data/2026/CVE-2026-31699.json
+++ b/data/2026/CVE-2026-31699.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"0fb87e44b81385f940b482cba5b3f0bd18fb8185","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"372116eece159adff631b1508344c8b85ebf9559","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"607ba280f2adb5092cf5386c3935afac2ca0031a","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"59e9ae81f8670ccc780bc75f45a355736f640ec9","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"111dcc6d0f016076745824a787d25609d0022f4c","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"3b4fd8f15765d9a3105b834dba8a05d025e5e16e","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"abe4a6d6f606113251868c2c4a06ba904bb41eed","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A32447F-A6C2-4D97-8B3B-EB4280574173","versionEndExcluding":"6.6.136","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed\n\nWhen retrieving the PEK CSR, don't attempt to copy the blob to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405\n\n  CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872\n   sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."}],"id":"CVE-2026-31699","lastModified":"2026-10-19T20:17:56.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:39.967438Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.777","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0fb87e44b81385f940b482cba5b3f0bd18fb8185"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/111dcc6d0f016076745824a787d25609d0022f4c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/372116eece159adff631b1508344c8b85ebf9559"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b4fd8f15765d9a3105b834dba8a05d025e5e16e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59e9ae81f8670ccc780bc75f45a355736f640ec9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/607ba280f2adb5092cf5386c3935afac2ca0031a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/abe4a6d6f606113251868c2c4a06ba904bb41eed"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"0fb87e44b81385f940b482cba5b3f0bd18fb8185","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"372116eece159adff631b1508344c8b85ebf9559","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"607ba280f2adb5092cf5386c3935afac2ca0031a","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"59e9ae81f8670ccc780bc75f45a355736f640ec9","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"111dcc6d0f016076745824a787d25609d0022f4c","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"3b4fd8f15765d9a3105b834dba8a05d025e5e16e","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"},{"lessThan":"abe4a6d6f606113251868c2c4a06ba904bb41eed","status":"affected","version":"e799035609e1526761aa2f896a974b233d04d36d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/ccp/sev-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A32447F-A6C2-4D97-8B3B-EB4280574173","versionEndExcluding":"6.6.136","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed\n\nWhen retrieving the PEK CSR, don't attempt to copy the blob to userspace\nif the firmware command failed.  If the failure was due to an invalid\nlength, i.e. the userspace buffer+length was too small, copying the number\nof bytes _firmware_ requires will overflow the kernel-allocated buffer and\nleak data to userspace.\n\n  BUG: KASAN: slab-out-of-bounds in instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n  BUG: KASAN: slab-out-of-bounds in _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n  BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n  Read of size 2084 at addr ffff898144612e20 by task syz.9.219/21405\n\n  CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0xc5/0x110 ../lib/dump_stack.c:120\n   print_address_description ../mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 ../mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 ../mm/kasan/report.c:595\n   check_region_inline ../mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 ../mm/kasan/generic.c:200\n   instrument_copy_to_user ../include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user ../include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 ../lib/usercopy.c:26\n   copy_to_user ../include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pek_csr+0x31f/0x590 ../drivers/crypto/ccp/sev-dev.c:1872\n   sev_ioctl+0x3a4/0x490 ../drivers/crypto/ccp/sev-dev.c:2562\n   vfs_ioctl ../fs/ioctl.c:51 [inline]\n   __do_sys_ioctl ../fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 ../fs/ioctl.c:583\n   do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 ../arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>\n\nWARN if the driver says the command succeeded, but the firmware error code\nsays otherwise, as __sev_do_cmd_locked() is expected to return -EIO on any\nfirwmware error."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: ccp: No intente copiar el CSR al espacio de usuario si el comando PSP falló\n\nAl recuperar el CSR de PEK, no intente copiar el blob al espacio de usuario si el comando del firmware falló. Si el fallo se debió a una longitud no válida, es decir, el búfer+longitud del espacio de usuario era demasiado pequeño, copiar el número de bytes que el firmware requiere desbordará el búfer asignado por el kernel y filtrará datos al espacio de usuario.\n\n  ERROR: KASAN: desbordamiento de slab en instrument_copy_to_user .. / include/linux/instrumented.h:129 [inline]\n  ERROR: KASAN: desbordamiento de slab en _inline_copy_to_user .. / include/linux/uaccess.h:205 [inline]\n  ERROR: KASAN: desbordamiento de slab en _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n  Lectura de tamaño 2084 en la dirección ffff898144612e20 por la tarea syz.9.219/21405\n\n  CPU: 14 UID: 0 PID: 21405 Comm: syz.9.219 Tainted: G     U     O        7.0.0-smp-DEV #28 PREEMPTLAZY\n  Tainted: [U]=USER, [O]=OOT_MODULE\n  Nombre del hardware: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025\n  Rastro de llamada:\n   [TAREA]\n   dump_stack_lvl+0xc5/0x110 .. / lib/dump_stack.c:120\n   print_address_description .. / mm/kasan/report.c:378 [inline]\n   print_report+0xbc/0x260 .. / mm/kasan/report.c:482\n   kasan_report+0xa2/0xe0 .. / mm/kasan/report.c:595\n   check_region_inline .. / mm/kasan/generic.c:-1 [inline]\n   kasan_check_range+0x264/0x2c0 .. / mm/kasan/generic.c:200\n   instrument_copy_to_user .. / include/linux/instrumented.h:129 [inline]\n   _inline_copy_to_user .. / include/linux/uaccess.h:205 [inline]\n   _copy_to_user+0x66/0xa0 .. / lib/usercopy.c:26\n   copy_to_user .. / include/linux/uaccess.h:236 [inline]\n   sev_ioctl_do_pek_csr+0x31f/0x590 .. / drivers/crypto/ccp/sev-dev.c:1872\n   sev_ioctl+0x3a4/0x490 .. / drivers/crypto/ccp/sev-dev.c:2562\n   vfs_ioctl .. / fs/ioctl.c:51 [inline]\n   __do_sys_ioctl .. / fs/ioctl.c:597 [inline]\n   __se_sys_ioctl+0x11d/0x1b0 .. / fs/ioctl.c:583\n   do_syscall_x64 .. / arch/x86/entry/syscall_64.c:63 [inline]\n   do_syscall_64+0xe0/0x800 .. / arch/x86/entry/syscall_64.c:94\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   [/TAREA]\n\nADVERTENCIA si el controlador dice que el comando tuvo éxito, pero el código de error del firmware dice lo contrario, ya que se espera que __sev_do_cmd_locked() devuelva -EIO ante cualquier error del firmware."}],"id":"CVE-2026-31699","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:39.967438Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.777","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0fb87e44b81385f940b482cba5b3f0bd18fb8185"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/111dcc6d0f016076745824a787d25609d0022f4c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/372116eece159adff631b1508344c8b85ebf9559"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b4fd8f15765d9a3105b834dba8a05d025e5e16e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/502d10a1d9d477e6c7fc7021a2dac7018f4ab8b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59e9ae81f8670ccc780bc75f45a355736f640ec9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/607ba280f2adb5092cf5386c3935afac2ca0031a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/abe4a6d6f606113251868c2c4a06ba904bb41eed"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31700.json b/data/2026/CVE-2026-31700.json
index 6736a71760..3d69615222 100644
--- a/data/2026/CVE-2026-31700.json
+++ b/data/2026/CVE-2026-31700.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f4c9754956b86de158a4af5278c5cf5bda9439e","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"714aa973da8163925eda7efd49361ccbee21ee46","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"1490f82353bdabc09265a74e645b07f05cf4188e","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"3a1bf9116ea31470b89692585c3910dfe830dcdd","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"28324a3b62d9ce7f9bdd65a8ce63f382041d1b27","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"2c054e17d9d41f1020376806c7f750834ced4dc5","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.6"},{"lessThan":"4.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7A6CE177-C7BA-4E34-9D61-035565B5FFF5","versionEndExcluding":"6.6.136","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()\n\nIn tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points\ndirectly into the mmap'd TX ring buffer shared with userspace. The\nkernel validates the header via __packet_snd_vnet_parse() but then\nre-reads all fields later in virtio_net_hdr_to_skb(). A concurrent\nuserspace thread can modify the vnet_hdr fields between validation\nand use, bypassing all safety checks.\n\nThe non-TPACKET path (packet_snd()) already correctly copies vnet_hdr\nto a stack-local variable. All other vnet_hdr consumers in the kernel\n(tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX\npath is the only caller of virtio_net_hdr_to_skb() that reads directly\nfrom user-controlled shared memory.\n\nFix this by copying vnet_hdr from the mmap'd ring buffer to a\nstack-local variable before validation and use, consistent with the\napproach used in packet_snd() and all other callers."}],"id":"CVE-2026-31700","lastModified":"2026-11-10T13:19:04.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31700","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:43.080685Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.907","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f4c9754956b86de158a4af5278c5cf5bda9439e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1490f82353bdabc09265a74e645b07f05cf4188e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28324a3b62d9ce7f9bdd65a8ce63f382041d1b27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c054e17d9d41f1020376806c7f750834ced4dc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a1bf9116ea31470b89692585c3910dfe830dcdd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/714aa973da8163925eda7efd49361ccbee21ee46"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-367"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f4c9754956b86de158a4af5278c5cf5bda9439e","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"714aa973da8163925eda7efd49361ccbee21ee46","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"1490f82353bdabc09265a74e645b07f05cf4188e","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"3a1bf9116ea31470b89692585c3910dfe830dcdd","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"28324a3b62d9ce7f9bdd65a8ce63f382041d1b27","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"},{"lessThan":"2c054e17d9d41f1020376806c7f750834ced4dc5","status":"affected","version":"1d036d25e5609ba73fee6a88db01c306b140d512","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.6"},{"lessThan":"4.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7A6CE177-C7BA-4E34-9D61-035565B5FFF5","versionEndExcluding":"6.6.136","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()\n\nIn tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points\ndirectly into the mmap'd TX ring buffer shared with userspace. The\nkernel validates the header via __packet_snd_vnet_parse() but then\nre-reads all fields later in virtio_net_hdr_to_skb(). A concurrent\nuserspace thread can modify the vnet_hdr fields between validation\nand use, bypassing all safety checks.\n\nThe non-TPACKET path (packet_snd()) already correctly copies vnet_hdr\nto a stack-local variable. All other vnet_hdr consumers in the kernel\n(tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX\npath is the only caller of virtio_net_hdr_to_skb() that reads directly\nfrom user-controlled shared memory.\n\nFix this by copying vnet_hdr from the mmap'd ring buffer to a\nstack-local variable before validation and use, consistent with the\napproach used in packet_snd() and all other callers."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/packet: corregir la condición de carrera TOCTOU en vnet_hdr mapeado por mmap en tpacket_snd()\n\nEn tpacket_snd(), cuando PACKET_VNET_HDR está habilitado, vnet_hdr apunta directamente al búfer de anillo TX mapeado por mmap compartido con el espacio de usuario. El kernel valida el encabezado a través de __packet_snd_vnet_parse() pero luego vuelve a leer todos los campos más tarde en virtio_net_hdr_to_skb(). Un hilo concurrente del espacio de usuario puede modificar los campos de vnet_hdr entre la validación y el uso, eludiendo todas las comprobaciones de seguridad.\n\nLa ruta no-TPACKET (packet_snd()) ya copia correctamente vnet_hdr a una variable local de la pila. Todos los demás consumidores de vnet_hdr en el kernel (tun.c, tap.c, virtio_net.c) también usan copias en la pila. La ruta TPACKET TX es el único llamador de virtio_net_hdr_to_skb() que lee directamente de memoria compartida controlada por el usuario.\n\nSolucione esto copiando vnet_hdr del búfer de anillo mapeado por mmap a una variable local de la pila antes de la validación y el uso, consistente con el enfoque utilizado en packet_snd() y todos los demás llamadores."}],"id":"CVE-2026-31700","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31700","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:43.080685Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:19.907","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f4c9754956b86de158a4af5278c5cf5bda9439e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1490f82353bdabc09265a74e645b07f05cf4188e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28324a3b62d9ce7f9bdd65a8ce63f382041d1b27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c054e17d9d41f1020376806c7f750834ced4dc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a1bf9116ea31470b89692585c3910dfe830dcdd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/714aa973da8163925eda7efd49361ccbee21ee46"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-367"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31701.json b/data/2026/CVE-2026-31701.json
index bf3a53aa96..50993c4bef 100644
--- a/data/2026/CVE-2026-31701.json
+++ b/data/2026/CVE-2026-31701.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"493b3a682ededc804555755f5d2193201339612d","status":"affected","version":"4dd821dcbfcecf7af6a08370b0b217cde2818acf","versionType":"git"},{"lessThan":"dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e","status":"affected","version":"cadf1d8e9ddcd74584ec961aeac14ac549b261d8","versionType":"git"},{"lessThan":"ac7345f68cda6989016d85d63f7b244c064aa8f6","status":"affected","version":"237f3faf0177bdde728fa3106d730d806436aa4d","versionType":"git"},{"lessThan":"f6634af5de728a46792f674a66d7843570cb68f7","status":"affected","version":"4507a8b9b30344c5ddd8219945f446d47e966a6d","versionType":"git"},{"lessThan":"1d9be95aee6c6246a21752e60c9519902649f482","status":"affected","version":"a3f9314752dbb6f6aa1f0f2b4c58243bda800738","versionType":"git"},{"lessThan":"6473ed16df1fe88051140611b3eb9a49be7f429e","status":"affected","version":"b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c","versionType":"git"},{"lessThan":"59b622a043cffc58b7638cd85ae6c30a0904f8e6","status":"affected","version":"b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c","versionType":"git"},{"lessThan":"80bb50e2d459213cccff3111d5ef98ed4238c0d5","status":"affected","version":"b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c","versionType":"git"},{"status":"affected","version":"3993edf44d3df7b6e8c753eac6ac8783473fcbab","versionType":"git"},{"status":"affected","version":"ebad462eec93b0f701dfe4de98990e7355283801","versionType":"git"},{"status":"affected","version":"dd0de8cb708951cebf727aa045e8242ba651bb52","versionType":"git"},{"lessThan":"5.10.258","status":"affected","version":"5.10.231","versionType":"semver"},{"lessThan":"5.15.209","status":"affected","version":"5.15.174","versionType":"semver"},{"lessThan":"6.1.175","status":"affected","version":"6.1.120","versionType":"semver"},{"lessThan":"6.6.136","status":"affected","version":"6.6.64","versionType":"semver"},{"lessThan":"6.12.84","status":"affected","version":"6.12.2","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.325","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.287","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*","matchCriteriaId":"5A3F9505-6B98-4269-8B81-127E55A1BF00","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: take a reference on the USB device in create_card()\n\nThe caiaq driver stores a pointer to the parent USB device in\ncdev->chip.dev but never takes a reference on it. The card's\nprivate_free callback, snd_usb_caiaq_card_free(), can run\nasynchronously via snd_card_free_when_closed() after the USB\ndevice has already been disconnected and freed, so any access to\ncdev->chip.dev in that path dereferences a freed usb_device.\n\nOn top of the refcounting issue, the current card_free implementation\ncalls usb_reset_device(cdev->chip.dev). A reset in a free callback\nis inappropriate: the device is going away, the call takes the\ndevice lock in a teardown context, and the reset races with the\ndisconnect path that the callback is already cleaning up after.\n\nTake a reference on the USB device in create_card() with\nusb_get_dev(), drop it with usb_put_dev() in the free callback,\nand remove the usb_reset_device() call."}],"id":"CVE-2026-31701","lastModified":"2026-11-06T16:18:08.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:35.844861Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:20.020","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d9be95aee6c6246a21752e60c9519902649f482"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/493b3a682ededc804555755f5d2193201339612d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59b622a043cffc58b7638cd85ae6c30a0904f8e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6473ed16df1fe88051140611b3eb9a49be7f429e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80bb50e2d459213cccff3111d5ef98ed4238c0d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ac7345f68cda6989016d85d63f7b244c064aa8f6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6634af5de728a46792f674a66d7843570cb68f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"493b3a682ededc804555755f5d2193201339612d","status":"affected","version":"4dd821dcbfcecf7af6a08370b0b217cde2818acf","versionType":"git"},{"lessThan":"dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e","status":"affected","version":"cadf1d8e9ddcd74584ec961aeac14ac549b261d8","versionType":"git"},{"lessThan":"ac7345f68cda6989016d85d63f7b244c064aa8f6","status":"affected","version":"237f3faf0177bdde728fa3106d730d806436aa4d","versionType":"git"},{"lessThan":"f6634af5de728a46792f674a66d7843570cb68f7","status":"affected","version":"4507a8b9b30344c5ddd8219945f446d47e966a6d","versionType":"git"},{"lessThan":"1d9be95aee6c6246a21752e60c9519902649f482","status":"affected","version":"a3f9314752dbb6f6aa1f0f2b4c58243bda800738","versionType":"git"},{"lessThan":"6473ed16df1fe88051140611b3eb9a49be7f429e","status":"affected","version":"b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c","versionType":"git"},{"lessThan":"59b622a043cffc58b7638cd85ae6c30a0904f8e6","status":"affected","version":"b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c","versionType":"git"},{"lessThan":"80bb50e2d459213cccff3111d5ef98ed4238c0d5","status":"affected","version":"b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c","versionType":"git"},{"status":"affected","version":"3993edf44d3df7b6e8c753eac6ac8783473fcbab","versionType":"git"},{"status":"affected","version":"ebad462eec93b0f701dfe4de98990e7355283801","versionType":"git"},{"status":"affected","version":"dd0de8cb708951cebf727aa045e8242ba651bb52","versionType":"git"},{"lessThan":"5.10.258","status":"affected","version":"5.10.231","versionType":"semver"},{"lessThan":"5.15.209","status":"affected","version":"5.15.174","versionType":"semver"},{"lessThan":"6.1.175","status":"affected","version":"6.1.120","versionType":"semver"},{"lessThan":"6.6.136","status":"affected","version":"6.6.64","versionType":"semver"},{"lessThan":"6.12.84","status":"affected","version":"6.12.2","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.325","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.287","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*","matchCriteriaId":"5A3F9505-6B98-4269-8B81-127E55A1BF00","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: take a reference on the USB device in create_card()\n\nThe caiaq driver stores a pointer to the parent USB device in\ncdev->chip.dev but never takes a reference on it. The card's\nprivate_free callback, snd_usb_caiaq_card_free(), can run\nasynchronously via snd_card_free_when_closed() after the USB\ndevice has already been disconnected and freed, so any access to\ncdev->chip.dev in that path dereferences a freed usb_device.\n\nOn top of the refcounting issue, the current card_free implementation\ncalls usb_reset_device(cdev->chip.dev). A reset in a free callback\nis inappropriate: the device is going away, the call takes the\ndevice lock in a teardown context, and the reset races with the\ndisconnect path that the callback is already cleaning up after.\n\nTake a reference on the USB device in create_card() with\nusb_get_dev(), drop it with usb_put_dev() in the free callback,\nand remove the usb_reset_device() call."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: caiaq: tomar una referencia en el dispositivo USB en create_card()\n\nEl controlador caiaq almacena un puntero al dispositivo USB padre en cdev  ->  chip.dev pero nunca toma una referencia sobre él. La devolución de llamada private_free de la tarjeta, snd_usb_caiaq_card_free(), puede ejecutarse asincrónicamente a través de snd_card_free_when_closed() después de que el dispositivo USB ya haya sido desconectado y liberado, por lo que cualquier acceso a cdev  ->  chip.dev en esa ruta desreferencia un usb_device liberado.\n\nAdemás del problema de conteo de referencias, la implementación actual de card_free llama a usb_reset_device(cdev  ->  chip.dev). Un reinicio en una devolución de llamada de liberación es inapropiado: el dispositivo está desapareciendo, la llamada toma el bloqueo del dispositivo en un contexto de desmantelamiento, y el reinicio compite con la ruta de desconexión que la devolución de llamada ya está limpiando.\n\nTomar una referencia en el dispositivo USB en create_card() con usb_get_dev(), liberarla con usb_put_dev() en la devolución de llamada de liberación, y eliminar la llamada a usb_reset_device()."}],"id":"CVE-2026-31701","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:35.844861Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:20.020","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d9be95aee6c6246a21752e60c9519902649f482"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/493b3a682ededc804555755f5d2193201339612d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59b622a043cffc58b7638cd85ae6c30a0904f8e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6473ed16df1fe88051140611b3eb9a49be7f429e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80bb50e2d459213cccff3111d5ef98ed4238c0d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ac7345f68cda6989016d85d63f7b244c064aa8f6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6634af5de728a46792f674a66d7843570cb68f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31702.json b/data/2026/CVE-2026-31702.json
index b6b2ed9e22..7d497f3688 100644
--- a/data/2026/CVE-2026-31702.json
+++ b/data/2026/CVE-2026-31702.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/compress.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"57bc678f36ac03281e877c6b84877b43f964143f","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"ef57cd3329b40c739b9a2e1a8a21ecc4171c6280","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"f5154cf3ce1c8193f0c1891d3769f62740cfe6fe","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"c76cf339b87975ae5b2c06d2d774d5667d25a12a","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"2c97dcb6147c8f7f25c629b93be1e69617de5d4a","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"39d4ee19c1e7d753dd655aebee632271b171f43a","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/compress.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.6"},{"lessThan":"5.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C8FF327A-4809-4F9C-B926-FF8D39DAAA1D","versionEndExcluding":"6.6.136","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()\n\nIn f2fs_compress_write_end_io(), dec_page_count(sbi, type) can bring\nthe F2FS_WB_CP_DATA counter to zero, unblocking\nf2fs_wait_on_all_pages() in f2fs_put_super() on a concurrent unmount\nCPU. The unmount path then proceeds to call\nf2fs_destroy_page_array_cache(sbi), which destroys\nsbi->page_array_slab via kmem_cache_destroy(), and eventually\nkfree(sbi). Meanwhile, the bio completion callback is still executing:\nwhen it reaches page_array_free(sbi, ...), it dereferences\nsbi->page_array_slab — a destroyed slab cache — to call\nkmem_cache_free(), causing a use-after-free.\n\nThis is the same class of bug as CVE-2026-23234 (which fixed the\nequivalent race in f2fs_write_end_io() in data.c), but in the\ncompressed writeback completion path that was not covered by that fix.\n\nFix this by moving dec_page_count() to after page_array_free(), so\nthat all sbi accesses complete before the counter decrement that can\nunblock unmount. For non-last folios (where atomic_dec_return on\ncic->pending_pages is nonzero), dec_page_count is called immediately\nbefore returning — page_array_free is not reached on this path, so\nthere is no post-decrement sbi access. For the last folio,\npage_array_free runs while the F2FS_WB_CP_DATA counter is still\nnonzero (this folio has not yet decremented it), keeping sbi alive,\nand dec_page_count runs as the final operation."}],"id":"CVE-2026-31702","lastModified":"2026-06-17T10:34:16.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:20.140","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c97dcb6147c8f7f25c629b93be1e69617de5d4a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39d4ee19c1e7d753dd655aebee632271b171f43a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/57bc678f36ac03281e877c6b84877b43f964143f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c76cf339b87975ae5b2c06d2d774d5667d25a12a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef57cd3329b40c739b9a2e1a8a21ecc4171c6280"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f5154cf3ce1c8193f0c1891d3769f62740cfe6fe"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/compress.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"57bc678f36ac03281e877c6b84877b43f964143f","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"ef57cd3329b40c739b9a2e1a8a21ecc4171c6280","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"f5154cf3ce1c8193f0c1891d3769f62740cfe6fe","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"c76cf339b87975ae5b2c06d2d774d5667d25a12a","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"2c97dcb6147c8f7f25c629b93be1e69617de5d4a","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"},{"lessThan":"39d4ee19c1e7d753dd655aebee632271b171f43a","status":"affected","version":"4c8ff7095bef64fc47e996a938f7d57f9e077da3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/compress.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.6"},{"lessThan":"5.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C8FF327A-4809-4F9C-B926-FF8D39DAAA1D","versionEndExcluding":"6.6.136","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()\n\nIn f2fs_compress_write_end_io(), dec_page_count(sbi, type) can bring\nthe F2FS_WB_CP_DATA counter to zero, unblocking\nf2fs_wait_on_all_pages() in f2fs_put_super() on a concurrent unmount\nCPU. The unmount path then proceeds to call\nf2fs_destroy_page_array_cache(sbi), which destroys\nsbi->page_array_slab via kmem_cache_destroy(), and eventually\nkfree(sbi). Meanwhile, the bio completion callback is still executing:\nwhen it reaches page_array_free(sbi, ...), it dereferences\nsbi->page_array_slab — a destroyed slab cache — to call\nkmem_cache_free(), causing a use-after-free.\n\nThis is the same class of bug as CVE-2026-23234 (which fixed the\nequivalent race in f2fs_write_end_io() in data.c), but in the\ncompressed writeback completion path that was not covered by that fix.\n\nFix this by moving dec_page_count() to after page_array_free(), so\nthat all sbi accesses complete before the counter decrement that can\nunblock unmount. For non-last folios (where atomic_dec_return on\ncic->pending_pages is nonzero), dec_page_count is called immediately\nbefore returning — page_array_free is not reached on this path, so\nthere is no post-decrement sbi access. For the last folio,\npage_array_free runs while the F2FS_WB_CP_DATA counter is still\nnonzero (this folio has not yet decremented it), keeping sbi alive,\nand dec_page_count runs as the final operation."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nf2fs: corrige el uso después de liberación de sbi en f2fs_compress_write_end_io()\n\nEn f2fs_compress_write_end_io(), dec_page_count(sbi, type) puede llevar el contador F2FS_WB_CP_DATA a cero, desbloqueando f2fs_wait_on_all_pages() en f2fs_put_super() en una CPU de desmontaje concurrente. La ruta de desmontaje luego procede a llamar a f2fs_destroy_page_array_cache(sbi), que destruye sbi  ->  page_array_slab a través de kmem_cache_destroy(), y finalmente kfree(sbi). Mientras tanto, la devolución de llamada de finalización de bio todavía se está ejecutando: cuando llega a page_array_free(sbi, ...), desreferencia sbi  ->  page_array_slab - una caché de slab destruida - para llamar a kmem_cache_free(), causando un uso después de liberación.\n\nEsta es la misma clase de error que CVE-2026-23234 (que corrigió la condición de carrera equivalente en f2fs_write_end_io() en data.c), pero en la ruta de finalización de escritura diferida comprimida que no fue cubierta por esa corrección.\n\nCorrige esto moviendo dec_page_count() a después de page_array_free(), para que todos los accesos a sbi se completen antes del decremento del contador que puede desbloquear el desmontaje. Para folios no finales (donde atomic_dec_return en cic  ->  pending_pages es distinto de cero), dec_page_count se llama inmediatamente antes de regresar - page_array_free no se alcanza en esta ruta, por lo que no hay acceso a sbi posterior al decremento. Para el último folio, page_array_free se ejecuta mientras el contador F2FS_WB_CP_DATA todavía es distinto de cero (este folio aún no lo ha decrementado), manteniendo sbi vivo, y dec_page_count se ejecuta como la operación final."}],"id":"CVE-2026-31702","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:20.140","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c97dcb6147c8f7f25c629b93be1e69617de5d4a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39d4ee19c1e7d753dd655aebee632271b171f43a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/57bc678f36ac03281e877c6b84877b43f964143f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c76cf339b87975ae5b2c06d2d774d5667d25a12a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef57cd3329b40c739b9a2e1a8a21ecc4171c6280"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f5154cf3ce1c8193f0c1891d3769f62740cfe6fe"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31703.json b/data/2026/CVE-2026-31703.json
index 4bda3dd6e7..f26e46241e 100644
--- a/data/2026/CVE-2026-31703.json
+++ b/data/2026/CVE-2026-31703.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/fs-writeback.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"382cf81cae89e58d22b4bdc38891cd4d0b9ba921","status":"affected","version":"d072b38a64ddbc2d58c2e525a24af24ecbfebcb7","versionType":"git"},{"lessThan":"19ec404b079be057b387643ba0c69bbcc5867c35","status":"affected","version":"ac7b2c21f2269d815ad0cdf0f8258d55185b805c","versionType":"git"},{"lessThan":"156cc63691c1f20905510b1007896e090355e6c2","status":"affected","version":"fabfc1fcddc5d8185722d4fde5f0968c4760b71e","versionType":"git"},{"lessThan":"028103656b84273c73e9e271cf95c9f3421f4b8a","status":"affected","version":"e1b849cfa6b61f1c866a908c9e8dd9b5aaab820b","versionType":"git"},{"lessThan":"9223e5f30403a9b506d6d0bff4f2e29a2d7d46af","status":"affected","version":"e1b849cfa6b61f1c866a908c9e8dd9b5aaab820b","versionType":"git"},{"lessThan":"6689f01d6740cf358932b3e97ee968c6099800d9","status":"affected","version":"e1b849cfa6b61f1c866a908c9e8dd9b5aaab820b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/fs-writeback.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5C53A705-D2E9-401E-9B1B-DBC8C4FE5181","versionEndExcluding":"6.18.25","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: Fix use after free in inode_switch_wbs_work_fn()\n\ninode_switch_wbs_work_fn() has a loop like:\n\n  wb_get(new_wb);\n  while (1) {\n    list = llist_del_all(&new_wb->switch_wbs_ctxs);\n    /* Nothing to do? */\n    if (!list)\n      break;\n    ... process the items ...\n  }\n\nNow adding of items to the list looks like:\n\nwb_queue_isw()\n  if (llist_add(&isw->list, &wb->switch_wbs_ctxs))\n    queue_work(isw_wq, &wb->switch_work);\n\nBecause inode_switch_wbs_work_fn() loops when processing isw items, it\ncan happen that wb->switch_work is pending while wb->switch_wbs_ctxs is\nempty. This is a problem because in that case wb can get freed (no isw\nitems -> no wb reference) while the work is still pending causing\nuse-after-free issues.\n\nWe cannot just fix this by cancelling work when freeing wb because that\ncould still trigger problematic 0 -> 1 transitions on wb refcount due to\nwb_get() in inode_switch_wbs_work_fn(). It could be all handled with\nmore careful code but that seems unnecessarily complex so let's avoid\nthat until it is proven that the looping actually brings practical\nbenefit. Just remove the loop from inode_switch_wbs_work_fn() instead.\nThat way when wb_queue_isw() queues work, we are guaranteed we have\nadded the first item to wb->switch_wbs_ctxs and nobody is going to\nremove it (and drop the wb reference it holds) until the queued work\nruns."}],"id":"CVE-2026-31703","lastModified":"2026-07-24T15:17:15.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"published":"2026-05-01T14:16:20.263","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/028103656b84273c73e9e271cf95c9f3421f4b8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/156cc63691c1f20905510b1007896e090355e6c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/19ec404b079be057b387643ba0c69bbcc5867c35"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/382cf81cae89e58d22b4bdc38891cd4d0b9ba921"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6689f01d6740cf358932b3e97ee968c6099800d9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9223e5f30403a9b506d6d0bff4f2e29a2d7d46af"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31703"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464385"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31703.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-825"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/fs-writeback.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"382cf81cae89e58d22b4bdc38891cd4d0b9ba921","status":"affected","version":"d072b38a64ddbc2d58c2e525a24af24ecbfebcb7","versionType":"git"},{"lessThan":"19ec404b079be057b387643ba0c69bbcc5867c35","status":"affected","version":"ac7b2c21f2269d815ad0cdf0f8258d55185b805c","versionType":"git"},{"lessThan":"156cc63691c1f20905510b1007896e090355e6c2","status":"affected","version":"fabfc1fcddc5d8185722d4fde5f0968c4760b71e","versionType":"git"},{"lessThan":"028103656b84273c73e9e271cf95c9f3421f4b8a","status":"affected","version":"e1b849cfa6b61f1c866a908c9e8dd9b5aaab820b","versionType":"git"},{"lessThan":"9223e5f30403a9b506d6d0bff4f2e29a2d7d46af","status":"affected","version":"e1b849cfa6b61f1c866a908c9e8dd9b5aaab820b","versionType":"git"},{"lessThan":"6689f01d6740cf358932b3e97ee968c6099800d9","status":"affected","version":"e1b849cfa6b61f1c866a908c9e8dd9b5aaab820b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/fs-writeback.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5C53A705-D2E9-401E-9B1B-DBC8C4FE5181","versionEndExcluding":"6.18.25","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: Fix use after free in inode_switch_wbs_work_fn()\n\ninode_switch_wbs_work_fn() has a loop like:\n\n  wb_get(new_wb);\n  while (1) {\n    list = llist_del_all(&new_wb->switch_wbs_ctxs);\n    /* Nothing to do? */\n    if (!list)\n      break;\n    ... process the items ...\n  }\n\nNow adding of items to the list looks like:\n\nwb_queue_isw()\n  if (llist_add(&isw->list, &wb->switch_wbs_ctxs))\n    queue_work(isw_wq, &wb->switch_work);\n\nBecause inode_switch_wbs_work_fn() loops when processing isw items, it\ncan happen that wb->switch_work is pending while wb->switch_wbs_ctxs is\nempty. This is a problem because in that case wb can get freed (no isw\nitems -> no wb reference) while the work is still pending causing\nuse-after-free issues.\n\nWe cannot just fix this by cancelling work when freeing wb because that\ncould still trigger problematic 0 -> 1 transitions on wb refcount due to\nwb_get() in inode_switch_wbs_work_fn(). It could be all handled with\nmore careful code but that seems unnecessarily complex so let's avoid\nthat until it is proven that the looping actually brings practical\nbenefit. Just remove the loop from inode_switch_wbs_work_fn() instead.\nThat way when wb_queue_isw() queues work, we are guaranteed we have\nadded the first item to wb->switch_wbs_ctxs and nobody is going to\nremove it (and drop the wb reference it holds) until the queued work\nruns."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: writeback: Corrección de uso después de liberación en inode_switch_wbs_work_fn() inode_switch_wbs_work_fn() tiene un bucle como: wb_get(new_wb); while (1) { list = llist_del_all( y new_wb  ->  switch_wbs_ctxs); /* ¿Nada que hacer? */ if (!list) break; ... procesar los elementos ... } Ahora la adición de elementos a la lista se ve así: wb_queue_isw() if (llist_add( y isw  ->  list, y wb  ->  switch_wbs_ctxs)) queue_work(isw_wq, y wb  ->  switch_work); Debido a que inode_switch_wbs_work_fn() itera al procesar elementos isw, puede ocurrir que wb  ->  switch_work esté pendiente mientras wb  ->  switch_wbs_ctxs esté vacío. Esto es un problema porque en ese caso wb puede ser liberado (sin elementos isw   ->   sin referencia a wb) mientras el trabajo aún está pendiente, causando problemas de uso después de liberación. No podemos simplemente solucionar esto cancelando el trabajo al liberar wb porque eso aún podría desencadenar transiciones problemáticas de 0 -mayor que 1 en el contador de referencias de wb debido a wb_get() en inode_switch_wbs_work_fn(). Todo podría manejarse con un código más cuidadoso, pero eso parece innecesariamente complejo, así que evitemos eso hasta que se demuestre que la iteración realmente aporta un beneficio práctico. Simplemente eliminemos el bucle de inode_switch_wbs_work_fn() en su lugar. De esa manera, cuando wb_queue_isw() encola trabajo, se nos garantiza que hemos añadido el primer elemento a wb  ->  switch_wbs_ctxs y nadie lo va a eliminar (y soltar la referencia a wb que contiene) hasta que se ejecute el trabajo encolado."}],"id":"CVE-2026-31703","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"published":"2026-05-01T14:16:20.263","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/028103656b84273c73e9e271cf95c9f3421f4b8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/156cc63691c1f20905510b1007896e090355e6c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/19ec404b079be057b387643ba0c69bbcc5867c35"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/382cf81cae89e58d22b4bdc38891cd4d0b9ba921"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6689f01d6740cf358932b3e97ee968c6099800d9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9223e5f30403a9b506d6d0bff4f2e29a2d7d46af"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31703"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464385"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31703.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-825"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31704.json b/data/2026/CVE-2026-31704.json
index 64c879e48d..9c7c1b31e4 100644
--- a/data/2026/CVE-2026-31704.json
+++ b/data/2026/CVE-2026-31704.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"41e53a773db6342ac9a689ee5ba635c31744c9f0","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"8d5729350b236896f51379588d9a690b7fafb8db","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"e1955a94b6f17f4b058afa955a6f187eb3ed7615","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"299f962c0b02d048fb45d248b4da493d03f3175d","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use check_add_overflow() to prevent u16 DACL size overflow\n\nset_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes\nin u16 variables. When a file has many POSIX ACL entries, the\naccumulated size can wrap past 65535, causing the pointer arithmetic\n(char *)pndace + *size to land within already-written ACEs. Subsequent\nwrites then overwrite earlier entries, and pndacl->size gets a\ntruncated value.\n\nUse check_add_overflow() at each accumulation point to detect the\nwrap before it corrupts the buffer, consistent with existing\ncheck_mul_overflow() usage elsewhere in smbacl.c."}],"id":"CVE-2026-31704","lastModified":"2026-10-15T02:19:18.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:20.367","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/299f962c0b02d048fb45d248b4da493d03f3175d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/41e53a773db6342ac9a689ee5ba635c31744c9f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d5729350b236896f51379588d9a690b7fafb8db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1955a94b6f17f4b058afa955a6f187eb3ed7615"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"41e53a773db6342ac9a689ee5ba635c31744c9f0","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"8d5729350b236896f51379588d9a690b7fafb8db","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"e1955a94b6f17f4b058afa955a6f187eb3ed7615","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"299f962c0b02d048fb45d248b4da493d03f3175d","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use check_add_overflow() to prevent u16 DACL size overflow\n\nset_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes\nin u16 variables. When a file has many POSIX ACL entries, the\naccumulated size can wrap past 65535, causing the pointer arithmetic\n(char *)pndace + *size to land within already-written ACEs. Subsequent\nwrites then overwrite earlier entries, and pndacl->size gets a\ntruncated value.\n\nUse check_add_overflow() at each accumulation point to detect the\nwrap before it corrupts the buffer, consistent with existing\ncheck_mul_overflow() usage elsewhere in smbacl.c."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: usar check_add_overflow() para prevenir el desbordamiento de tamaño de DACL u16\n\nset_posix_acl_entries_dacl() y set_ntacl_dacl() acumulan tamaños de ACE en variables u16. Cuando un archivo tiene muchas entradas ACL POSIX, el tamaño acumulado puede desbordarse más allá de 65535, causando que la aritmética de punteros (char *)pndace + size aterrice dentro de ACEs ya escritos. Las escrituras subsiguientes luego sobrescriben entradas anteriores, y pndacl  ->  size obtiene un valor truncado.\n\nUsar check_add_overflow() en cada punto de acumulación para detectar el desbordamiento antes de que corrompa el búfer, consistente con el uso existente de check_mul_overflow() en otras partes de smbacl.c."}],"id":"CVE-2026-31704","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:20.367","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/299f962c0b02d048fb45d248b4da493d03f3175d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/41e53a773db6342ac9a689ee5ba635c31744c9f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e7b8f3c539d69b2ed5f2408e2f75e68ce7eef43"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d5729350b236896f51379588d9a690b7fafb8db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1955a94b6f17f4b058afa955a6f187eb3ed7615"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef7902be3f215b6bf7babe4dc9dd9a7d57dad7a7"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31705.json b/data/2026/CVE-2026-31705.json
index 0808166c51..8ac188dc89 100644
--- a/data/2026/CVE-2026-31705.json
+++ b/data/2026/CVE-2026-31705.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ddbbc8b2a09dd2cfed90871313e3691ae1db08a2","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"ffbce350c6fd1e99116ea57383b9031717e36d3b","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"98f3de6ef4efbd899348d333f0902dc4ff14380c","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"790304c02bf9bd7b8171feda4294d6e62d32ae8f","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"922d48fe8c19f388ffa2f709f33acaae4e408de2","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"30010c952077a1c89ecdd71fc4d574c75a8f5617","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"status":"affected","version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git"},{"lessThan":"6.1.175","status":"affected","version":"6.1.71","versionType":"semver"},{"lessThan":"5.16","status":"affected","version":"5.15.145","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B98C9201-BF17-4E2C-84FF-75EE2AA94DC5","versionEndExcluding":"5.16","versionStartIncluding":"5.15.145","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"163E72B5-0F5D-49E2-AAEA-F11E02D730AD","versionEndExcluding":"6.2","versionStartIncluding":"6.1.71","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D1C8822E-08AF-49C3-8A31-F806E5FAE5E7","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\n\nsmb2_get_ea() applies 4-byte alignment padding via memset() after\nwriting each EA entry. The bounds check on buf_free_len is performed\nbefore the value memcpy, but the alignment memset fires unconditionally\nafterward with no check on remaining space.\n\nWhen the EA value exactly fills the remaining buffer (buf_free_len == 0\nafter value subtraction), the alignment memset writes 1-3 NUL bytes\npast the buf_free_len boundary. In compound requests where the response\nbuffer is shared across commands, the first command (e.g., READ) can\nconsume most of the buffer, leaving a tight remainder for the QUERY_INFO\nEA response. The alignment memset then overwrites past the physical\nkvmalloc allocation into adjacent kernel heap memory.\n\nAdd a bounds check before the alignment memset to ensure buf_free_len\ncan accommodate the padding bytes.\n\nThis is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix\npotencial OOB in get_file_all_info() for compound requests\") and\ncommit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound\nrequests\"), both of which added bounds checks before unconditional\nwrites in QUERY_INFO response handlers."}],"id":"CVE-2026-31705","lastModified":"2026-10-15T02:19:18.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:20.473","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ddbbc8b2a09dd2cfed90871313e3691ae1db08a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ddbbc8b2a09dd2cfed90871313e3691ae1db08a2","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"ffbce350c6fd1e99116ea57383b9031717e36d3b","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"98f3de6ef4efbd899348d333f0902dc4ff14380c","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"790304c02bf9bd7b8171feda4294d6e62d32ae8f","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"922d48fe8c19f388ffa2f709f33acaae4e408de2","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"30010c952077a1c89ecdd71fc4d574c75a8f5617","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"status":"affected","version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git"},{"lessThan":"6.1.175","status":"affected","version":"6.1.71","versionType":"semver"},{"lessThan":"5.16","status":"affected","version":"5.15.145","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B98C9201-BF17-4E2C-84FF-75EE2AA94DC5","versionEndExcluding":"5.16","versionStartIncluding":"5.15.145","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"163E72B5-0F5D-49E2-AAEA-F11E02D730AD","versionEndExcluding":"6.2","versionStartIncluding":"6.1.71","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D1C8822E-08AF-49C3-8A31-F806E5FAE5E7","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\n\nsmb2_get_ea() applies 4-byte alignment padding via memset() after\nwriting each EA entry. The bounds check on buf_free_len is performed\nbefore the value memcpy, but the alignment memset fires unconditionally\nafterward with no check on remaining space.\n\nWhen the EA value exactly fills the remaining buffer (buf_free_len == 0\nafter value subtraction), the alignment memset writes 1-3 NUL bytes\npast the buf_free_len boundary. In compound requests where the response\nbuffer is shared across commands, the first command (e.g., READ) can\nconsume most of the buffer, leaving a tight remainder for the QUERY_INFO\nEA response. The alignment memset then overwrites past the physical\nkvmalloc allocation into adjacent kernel heap memory.\n\nAdd a bounds check before the alignment memset to ensure buf_free_len\ncan accommodate the padding bytes.\n\nThis is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix\npotencial OOB in get_file_all_info() for compound requests\") and\ncommit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound\nrequests\"), both of which added bounds checks before unconditional\nwrites in QUERY_INFO response handlers."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corrección de escritura fuera de límites en la alineación de EA de smb2_get_ea()\n\nsmb2_get_ea() aplica relleno de alineación de 4 bytes a través de memset() después de escribir cada entrada de EA. La comprobación de límites en buf_free_len se realiza antes del memcpy del valor, pero el memset de alineación se activa incondicionalmente después sin una comprobación del espacio restante.\n\nCuando el valor de EA llena exactamente el búfer restante (buf_free_len == 0 después de la resta del valor), el memset de alineación escribe de 1 a 3 bytes NUL más allá del límite de buf_free_len. En solicitudes compuestas donde el búfer de respuesta se comparte entre comandos, el primer comando (p. ej., READ) puede consumir la mayor parte del búfer, dejando un resto ajustado para la respuesta de EA de QUERY_INFO. El memset de alineación luego sobrescribe más allá de la asignación física de kvmalloc en la memoria adyacente del heap del kernel.\n\nAñadir una comprobación de límites antes del memset de alineación para asegurar que buf_free_len pueda acomodar los bytes de relleno.\n\nEste es el mismo patrón de error corregido por el commit beef2634f81f (’ksmbd: fix potencial OOB in get_file_all_info() for compound requests’) y el commit fda9522ed6af (’ksmbd: fix OOB write in QUERY_INFO for compound requests’), ambos de los cuales añadieron comprobaciones de límites antes de escrituras incondicionales en los manejadores de respuesta de QUERY_INFO."}],"id":"CVE-2026-31705","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:20.473","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ddbbc8b2a09dd2cfed90871313e3691ae1db08a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31706.json b/data/2026/CVE-2026-31706.json
index 99fe0161c0..dfa59df78f 100644
--- a/data/2026/CVE-2026-31706.json
+++ b/data/2026/CVE-2026-31706.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4d37830c2c834987de329d58fb9a319067400361","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"ad7d18df7423c522ed9dc7e33bd5d54c66b1bc37","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"063a7409b0de46d7c770b65bb0338e6fdb3b1f0a","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"3e5360b422dd741cb315654a191fa73869a37414","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"59c32abaaec9cdd6164811c7e864e72f7554b82d","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"3e4e2ea2a781018ed5d75f969e3e5606beb66e48","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04651641-C387-4546-B02F-17BA989CC253","versionEndExcluding":"6.12.84","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()\n\nsmb_inherit_dacl() trusts the on-disk num_aces value from the parent\ndirectory's DACL xattr and uses it to size a heap allocation:\n\n  aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...);\n\nnum_aces is a u16 read from le16_to_cpu(parent_pdacl->num_aces)\nwithout checking that it is consistent with the declared pdacl_size.\nAn authenticated client whose parent directory's security.NTACL is\ntampered (e.g. via offline xattr corruption or a concurrent path that\nbypasses parse_dacl()) can present num_aces = 65535 with minimal\nactual ACE data.  This causes a ~8 MB allocation (not kzalloc, so\nuninitialized) that the subsequent loop only partially populates, and\nmay also overflow the three-way size_t multiply on 32-bit kernels.\n\nAdditionally, the ACE walk loop uses the weaker\noffsetof(struct smb_ace, access_req) minimum size check rather than\nthe minimum valid on-wire ACE size, and does not reject ACEs whose\ndeclared size is below the minimum.\n\nReproduced on UML + KASAN + LOCKDEP against the real ksmbd code path.\nA legitimate mount.cifs client creates a parent directory over SMB\n(ksmbd writes a valid security.NTACL xattr), then the NTACL blob on\nthe backing filesystem is rewritten to set num_aces = 0xFFFF while\nkeeping the posix_acl_hash bytes intact so ksmbd_vfs_get_sd_xattr()'s\nhash check still passes.  A subsequent SMB2 CREATE of a child under\nthat parent drives smb2_open() into smb_inherit_dacl() (share has\n\"vfs objects = acl_xattr\" set), which fails the page allocator:\n\n  WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof+0x46c/0x9c0\n  Workqueue: ksmbd-io handle_ksmbd_work\n   __alloc_frozen_pages_noprof+0x46c/0x9c0\n   ___kmalloc_large_node+0x68/0x130\n   __kmalloc_large_node_noprof+0x24/0x70\n   __kmalloc_noprof+0x4c9/0x690\n   smb_inherit_dacl+0x394/0x2430\n   smb2_open+0x595d/0xabe0\n   handle_ksmbd_work+0x3d3/0x1140\n\nWith the patch applied the added guard rejects the tampered value\nwith -EINVAL before any large allocation runs, smb2_open() falls back\nto smb2_create_sd_buffer(), and the child is created with a default\nSD.  No warning, no splat.\n\nFix by:\n\n  1. Validating num_aces against pdacl_size using the same formula\n     applied in parse_dacl().\n\n  2. Replacing the raw kmalloc(sizeof * num_aces * 2) with\n     kmalloc_array(num_aces * 2, sizeof(...)) for overflow-safe\n     allocation.\n\n  3. Tightening the per-ACE loop guard to require the minimum valid\n     ACE size (offsetof(smb_ace, sid) + CIFS_SID_BASE_SIZE) and\n     rejecting under-sized ACEs, matching the hardening in\n     smb_check_perm_dacl() and parse_dacl().\n\nv1 -> v2:\n  - Replace the synthetic test-module splat in the changelog with a\n    real-path UML + KASAN reproduction driven through mount.cifs and\n    SMB2 CREATE; Namjae flagged the kcifs3_test_inherit_dacl_old name\n    in v1 since it does not exist in ksmbd.\n  - Drop the commit-hash citation from the code comment per Namjae's\n    review; keep the parse_dacl() pointer."}],"id":"CVE-2026-31706","lastModified":"2026-10-30T13:18:42.640","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:20.597","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/063a7409b0de46d7c770b65bb0338e6fdb3b1f0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e4e2ea2a781018ed5d75f969e3e5606beb66e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e5360b422dd741cb315654a191fa73869a37414"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4d37830c2c834987de329d58fb9a319067400361"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59c32abaaec9cdd6164811c7e864e72f7554b82d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ad7d18df7423c522ed9dc7e33bd5d54c66b1bc37"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4d37830c2c834987de329d58fb9a319067400361","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"ad7d18df7423c522ed9dc7e33bd5d54c66b1bc37","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"063a7409b0de46d7c770b65bb0338e6fdb3b1f0a","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"3e5360b422dd741cb315654a191fa73869a37414","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"59c32abaaec9cdd6164811c7e864e72f7554b82d","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"3e4e2ea2a781018ed5d75f969e3e5606beb66e48","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04651641-C387-4546-B02F-17BA989CC253","versionEndExcluding":"6.12.84","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()\n\nsmb_inherit_dacl() trusts the on-disk num_aces value from the parent\ndirectory's DACL xattr and uses it to size a heap allocation:\n\n  aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...);\n\nnum_aces is a u16 read from le16_to_cpu(parent_pdacl->num_aces)\nwithout checking that it is consistent with the declared pdacl_size.\nAn authenticated client whose parent directory's security.NTACL is\ntampered (e.g. via offline xattr corruption or a concurrent path that\nbypasses parse_dacl()) can present num_aces = 65535 with minimal\nactual ACE data.  This causes a ~8 MB allocation (not kzalloc, so\nuninitialized) that the subsequent loop only partially populates, and\nmay also overflow the three-way size_t multiply on 32-bit kernels.\n\nAdditionally, the ACE walk loop uses the weaker\noffsetof(struct smb_ace, access_req) minimum size check rather than\nthe minimum valid on-wire ACE size, and does not reject ACEs whose\ndeclared size is below the minimum.\n\nReproduced on UML + KASAN + LOCKDEP against the real ksmbd code path.\nA legitimate mount.cifs client creates a parent directory over SMB\n(ksmbd writes a valid security.NTACL xattr), then the NTACL blob on\nthe backing filesystem is rewritten to set num_aces = 0xFFFF while\nkeeping the posix_acl_hash bytes intact so ksmbd_vfs_get_sd_xattr()'s\nhash check still passes.  A subsequent SMB2 CREATE of a child under\nthat parent drives smb2_open() into smb_inherit_dacl() (share has\n\"vfs objects = acl_xattr\" set), which fails the page allocator:\n\n  WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof+0x46c/0x9c0\n  Workqueue: ksmbd-io handle_ksmbd_work\n   __alloc_frozen_pages_noprof+0x46c/0x9c0\n   ___kmalloc_large_node+0x68/0x130\n   __kmalloc_large_node_noprof+0x24/0x70\n   __kmalloc_noprof+0x4c9/0x690\n   smb_inherit_dacl+0x394/0x2430\n   smb2_open+0x595d/0xabe0\n   handle_ksmbd_work+0x3d3/0x1140\n\nWith the patch applied the added guard rejects the tampered value\nwith -EINVAL before any large allocation runs, smb2_open() falls back\nto smb2_create_sd_buffer(), and the child is created with a default\nSD.  No warning, no splat.\n\nFix by:\n\n  1. Validating num_aces against pdacl_size using the same formula\n     applied in parse_dacl().\n\n  2. Replacing the raw kmalloc(sizeof * num_aces * 2) with\n     kmalloc_array(num_aces * 2, sizeof(...)) for overflow-safe\n     allocation.\n\n  3. Tightening the per-ACE loop guard to require the minimum valid\n     ACE size (offsetof(smb_ace, sid) + CIFS_SID_BASE_SIZE) and\n     rejecting under-sized ACEs, matching the hardening in\n     smb_check_perm_dacl() and parse_dacl().\n\nv1 -> v2:\n  - Replace the synthetic test-module splat in the changelog with a\n    real-path UML + KASAN reproduction driven through mount.cifs and\n    SMB2 CREATE; Namjae flagged the kcifs3_test_inherit_dacl_old name\n    in v1 since it does not exist in ksmbd.\n  - Drop the commit-hash citation from the code comment per Namjae's\n    review; keep the parse_dacl() pointer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: ksmbd: validar num_aces y reforzar el recorrido de ACE en smb_inherit_dacl() smb_inherit_dacl() confía en el valor num_aces en disco del xattr DACL del directorio padre y lo usa para dimensionar una asignación de pila: aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...); num_aces es un u16 leído de le16_to_cpu(parent_pdacl  ->  num_aces) sin verificar que sea consistente con el pdacl_size declarado. Un cliente autenticado cuyo security.NTACL del directorio padre ha sido manipulado (por ejemplo, mediante corrupción de xattr fuera de línea o una ruta concurrente que omite parse_dacl()) puede presentar num_aces = 65535 con datos ACE reales mínimos. Esto causa una asignación de ~8 MB (no kzalloc, por lo tanto no inicializada) que el bucle subsiguiente solo rellena parcialmente, y también puede desbordar la multiplicación size_t de tres vías en kernels de 32 bits. Además, el bucle de recorrido de ACE usa la verificación de tamaño mínimo más débil offsetof(struct smb_ace, access_req) en lugar del tamaño mínimo válido de ACE en la red, y no rechaza los ACEs cuyo tamaño declarado está por debajo del mínimo. Reproducido en UML + KASAN + LOCKDEP contra la ruta de código real de ksmbd. Un cliente mount.cifs legítimo crea un directorio padre sobre SMB (ksmbd escribe un xattr security.NTACL válido), luego el blob NTACL en el sistema de archivos de respaldo es reescrito para establecer num_aces = 0x FFFF mientras mantiene intactos los bytes posix_acl_hash para que la verificación de hash de ksmbd_vfs_get_sd_xattr() aún pase. Un SMB2 CREATE subsiguiente de un hijo bajo ese padre lleva a smb2_open() a smb_inherit_dacl() (el recurso compartido tiene ’vfs objects = acl_xattr’ configurado), lo que hace fallar al asignador de páginas: WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof+0x46c/0x9c0 Workqueue: ksmbd-io handle_ksmbd_work __alloc_frozen_pages_noprof+0x46c/0x9c0 ___kmalloc_large_node+0x68/0x130 __kmalloc_large_node_noprof+0x24/0x70 __kmalloc_noprof+0x4c9/0x690 smb_inherit_dacl+0x394/0x 2430 smb2_open+0x 595d/0x abe0 handle_ksmbd_work+0x3d3/0x 1140 Con el parche aplicado, la protección añadida rechaza el valor manipulado con -EINVAL antes de que se ejecute cualquier asignación grande, smb2_open() recurre a smb2_create_sd_buffer(), y el hijo se crea con un SD predeterminado. Sin advertencia, sin error. Solución mediante: 1. Validar num_aces contra pdacl_size usando la misma fórmula aplicada en parse_dacl(). 2. Reemplazar el kmalloc(sizeof * num_aces * 2) en bruto con kmalloc_array(num_aces * 2, sizeof(...)) para una asignación segura contra desbordamientos. 3. Ajustar la protección del bucle por ACE para requerir el tamaño mínimo válido de ACE (offsetof(smb_ace, sid) + CIFS_SID_BASE_SIZE) y rechazar los ACEs de tamaño insuficiente, coincidiendo con el refuerzo en smb_check_perm_dacl() y parse_dacl(). v1 -mayor que v2: - Reemplazar el error del módulo de prueba sintético en el registro de cambios con una reproducción de ruta real de UML + KASAN impulsada a través de mount.cifs y SMB2 CREATE; Namjae señaló el nombre kcifs3_test_inherit_dacl_old en v1 ya que no existe en ksmbd. - Eliminar la cita del hash de commit del comentario del código según la revisión de Namjae; mantener el puntero de parse_dacl()."}],"id":"CVE-2026-31706","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:20.597","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/063a7409b0de46d7c770b65bb0338e6fdb3b1f0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e4e2ea2a781018ed5d75f969e3e5606beb66e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e5360b422dd741cb315654a191fa73869a37414"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4d37830c2c834987de329d58fb9a319067400361"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59c32abaaec9cdd6164811c7e864e72f7554b82d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ad7d18df7423c522ed9dc7e33bd5d54c66b1bc37"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31707.json b/data/2026/CVE-2026-31707.json
index 460dc39235..1618426c5e 100644
--- a/data/2026/CVE-2026-31707.json
+++ b/data/2026/CVE-2026-31707.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/mgmt/user_config.c","fs/smb/server/transport_ipc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"52518503a1a00bc33e9522c4eb05df023e3ae978","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"bf396208418371174869baba9434535cd3288e80","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"7dd0c858e1909769a4c91842724315ee74f1a5f1","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"299db777ea0cfa5c407e41b045c24a14c034c27b","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"99c631d0366c1eab8fb188fe66425f4581ebdde4","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"d6a6aa81eac2c9bff66dc6e191179cb69a14426b","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/mgmt/user_config.c","fs/smb/server/transport_ipc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.141","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04651641-C387-4546-B02F-17BA989CC253","versionEndExcluding":"6.12.84","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate response sizes in ipc_validate_msg()\n\nipc_validate_msg() computes the expected message size for each\nresponse type by adding (or multiplying) attacker-controlled fields\nfrom the daemon response to a fixed struct size in unsigned int\narithmetic.  Three cases can overflow:\n\n  KSMBD_EVENT_RPC_REQUEST:\n      msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz;\n  KSMBD_EVENT_SHARE_CONFIG_REQUEST:\n      msg_sz = sizeof(struct ksmbd_share_config_response) +\n               resp->payload_sz;\n  KSMBD_EVENT_LOGIN_REQUEST_EXT:\n      msg_sz = sizeof(struct ksmbd_login_response_ext) +\n               resp->ngroups * sizeof(gid_t);\n\nresp->payload_sz is __u32 and resp->ngroups is __s32.  Each addition\ncan wrap in unsigned int; the multiplication by sizeof(gid_t) mixes\nsigned and size_t, so a negative ngroups is converted to SIZE_MAX\nbefore the multiply.  A wrapped value of msg_sz that happens to\nequal entry->msg_sz bypasses the size check on the next line, and\ndownstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz,\nkmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the\nunverified length.\n\nUse check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST\npaths to detect integer overflow without constraining functional\npayload size; userspace ksmbd-tools grows NDR responses in 4096-byte\nchunks for calls like NetShareEnumAll, so a hard transport cap is\nunworkable on the response side.  For LOGIN_REQUEST_EXT, reject\nresp->ngroups outside the signed [0, NGROUPS_MAX] range up front and\nreport the error from ipc_validate_msg() so it fires at the IPC\nboundary; with that bound the subsequent multiplication and addition\nstay well below UINT_MAX.  The now-redundant ngroups check and\npr_err in ksmbd_alloc_user() are removed.\n\nThis is the response-side analogue of aab98e2dbd64 (\"ksmbd: fix\ninteger overflows on 32 bit systems\"), which hardened the request\nside."}],"id":"CVE-2026-31707","lastModified":"2026-10-30T13:18:42.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:20.720","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/52518503a1a00bc33e9522c4eb05df023e3ae978"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bf396208418371174869baba9434535cd3288e80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/mgmt/user_config.c","fs/smb/server/transport_ipc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"52518503a1a00bc33e9522c4eb05df023e3ae978","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"bf396208418371174869baba9434535cd3288e80","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"7dd0c858e1909769a4c91842724315ee74f1a5f1","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"299db777ea0cfa5c407e41b045c24a14c034c27b","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"99c631d0366c1eab8fb188fe66425f4581ebdde4","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"d6a6aa81eac2c9bff66dc6e191179cb69a14426b","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/mgmt/user_config.c","fs/smb/server/transport_ipc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.141","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04651641-C387-4546-B02F-17BA989CC253","versionEndExcluding":"6.12.84","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate response sizes in ipc_validate_msg()\n\nipc_validate_msg() computes the expected message size for each\nresponse type by adding (or multiplying) attacker-controlled fields\nfrom the daemon response to a fixed struct size in unsigned int\narithmetic.  Three cases can overflow:\n\n  KSMBD_EVENT_RPC_REQUEST:\n      msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz;\n  KSMBD_EVENT_SHARE_CONFIG_REQUEST:\n      msg_sz = sizeof(struct ksmbd_share_config_response) +\n               resp->payload_sz;\n  KSMBD_EVENT_LOGIN_REQUEST_EXT:\n      msg_sz = sizeof(struct ksmbd_login_response_ext) +\n               resp->ngroups * sizeof(gid_t);\n\nresp->payload_sz is __u32 and resp->ngroups is __s32.  Each addition\ncan wrap in unsigned int; the multiplication by sizeof(gid_t) mixes\nsigned and size_t, so a negative ngroups is converted to SIZE_MAX\nbefore the multiply.  A wrapped value of msg_sz that happens to\nequal entry->msg_sz bypasses the size check on the next line, and\ndownstream consumers (smb2pdu.c:6742 memcpy using rpc_resp->payload_sz,\nkmemdup in ksmbd_alloc_user using resp_ext->ngroups) then trust the\nunverified length.\n\nUse check_add_overflow() on the RPC_REQUEST and SHARE_CONFIG_REQUEST\npaths to detect integer overflow without constraining functional\npayload size; userspace ksmbd-tools grows NDR responses in 4096-byte\nchunks for calls like NetShareEnumAll, so a hard transport cap is\nunworkable on the response side.  For LOGIN_REQUEST_EXT, reject\nresp->ngroups outside the signed [0, NGROUPS_MAX] range up front and\nreport the error from ipc_validate_msg() so it fires at the IPC\nboundary; with that bound the subsequent multiplication and addition\nstay well below UINT_MAX.  The now-redundant ngroups check and\npr_err in ksmbd_alloc_user() are removed.\n\nThis is the response-side analogue of aab98e2dbd64 (\"ksmbd: fix\ninteger overflows on 32 bit systems\"), which hardened the request\nside."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: validar tamaños de respuesta en ipc_validate_msg()\n\nipc_validate_msg() calcula el tamaño de mensaje esperado para cada tipo de respuesta sumando (o multiplicando) campos controlados por el atacante de la respuesta del demonio a un tamaño de estructura fijo en aritmética de entero sin signo. Tres casos pueden desbordarse:\n\n  KSMBD_EVENT_RPC_REQUEST:\n      msg_sz = sizeof(struct ksmbd_rpc_command) + resp  ->  payload_sz;\n  KSMBD_EVENT_SHARE_CONFIG_REQUEST:\n      msg_sz = sizeof(struct ksmbd_share_config_response) +\n               resp  ->  payload_sz;\n  KSMBD_EVENT_LOGIN_REQUEST_EXT:\n      msg_sz = sizeof(struct ksmbd_login_response_ext) +\n               resp  ->  ngroups * sizeof(gid_t);\n\nresp  ->  payload_sz es __u32 y resp  ->  ngroups es __s32. Cada suma puede envolverse en entero sin signo; la multiplicación por sizeof(gid_t) mezcla con signo y size_t, por lo que un ngroups negativo se convierte a SIZE_MAX antes de la multiplicación. Un valor envuelto de msg_sz que resulta ser igual a entry  ->  msg_sz omite la comprobación de tamaño en la siguiente línea, y los consumidores posteriores (smb2pdu.c:6742 memcpy usando rpc_resp  ->  payload_sz, kmemdup en ksmbd_alloc_user usando resp_ext  ->  ngroups) entonces confían en la longitud no verificada.\n\nUsar check_add_overflow() en las rutas RPC_REQUEST y SHARE_CONFIG_REQUEST para detectar desbordamiento de entero sin restringir el tamaño de carga útil funcional; las herramientas ksmbd del espacio de usuario aumentan las respuestas NDR en bloques de 4096 bytes para llamadas como NetShareEnumAll, por lo que un límite de transporte estricto es inviable en el lado de la respuesta. Para LOGIN_REQUEST_EXT, rechazar resp  ->  ngroups fuera del rango con signo [0, NGROUPS_MAX] de antemano y reportar el error desde ipc_validate_msg() para que se active en el límite IPC; con ese límite la multiplicación y suma subsiguientes se mantienen muy por debajo de UINT_MAX. La comprobación de ngroups ahora redundante y pr_err en ksmbd_alloc_user() se eliminan.\n\nEste es el análogo del lado de la respuesta de aab98e2dbd64 (’ksmbd: corregir desbordamientos de entero en sistemas de 32 bits’), que reforzó el lado de la solicitud."}],"id":"CVE-2026-31707","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:20.720","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/299db777ea0cfa5c407e41b045c24a14c034c27b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/52518503a1a00bc33e9522c4eb05df023e3ae978"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7dd0c858e1909769a4c91842724315ee74f1a5f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/99c631d0366c1eab8fb188fe66425f4581ebdde4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bf396208418371174869baba9434535cd3288e80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6a6aa81eac2c9bff66dc6e191179cb69a14426b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31708.json b/data/2026/CVE-2026-31708.json
index 64858a1a8f..262ab72ea0 100644
--- a/data/2026/CVE-2026-31708.json
+++ b/data/2026/CVE-2026-31708.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e66bdc0704977ecee667a81d38255b579c2353d0","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"9e203dbb5402897c43130fb171a2617008a91f45","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"1dd757379997b71a328a4b591ffaf481acd0ead1","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"a34d456934fe42e4da5d2cc07787bf418bee99c6","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"ac2f14e4705d020f04e806efa0d49ab8dc2b145f","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"078fae8f50adebb903ccf2252b44391324571e78","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"85fd46ee26a11841c670449508025965f61ce131","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B28CAC2A-4B06-4D07-8736-82E515099010","versionEndExcluding":"6.6.136","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n\nsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL\nand the default QUERY_INFO path.  The QUERY_INFO branch clamps\nqi.input_buffer_length to the server-reported OutputBufferLength and then\ncopies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but\nit never verifies that the flexible-array payload actually fits within\nrsp_iov[1].iov_len.\n\nA malicious server can return OutputBufferLength larger than the actual\nQUERY_INFO response, causing copy_to_user() to walk past the response\nbuffer and expose adjacent kernel heap to userspace.\n\nGuard the QUERY_INFO copy with a bounds check on the actual Buffer\npayload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)\nrather than an open-coded addition so the guard cannot overflow on\n32-bit builds."}],"id":"CVE-2026-31708","lastModified":"2026-10-19T20:17:56.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:45.456025Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:20.837","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/078fae8f50adebb903ccf2252b44391324571e78"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1dd757379997b71a328a4b591ffaf481acd0ead1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/85fd46ee26a11841c670449508025965f61ce131"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e203dbb5402897c43130fb171a2617008a91f45"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a34d456934fe42e4da5d2cc07787bf418bee99c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac2f14e4705d020f04e806efa0d49ab8dc2b145f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e66bdc0704977ecee667a81d38255b579c2353d0"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e66bdc0704977ecee667a81d38255b579c2353d0","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"9e203dbb5402897c43130fb171a2617008a91f45","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"1dd757379997b71a328a4b591ffaf481acd0ead1","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"a34d456934fe42e4da5d2cc07787bf418bee99c6","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"ac2f14e4705d020f04e806efa0d49ab8dc2b145f","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"078fae8f50adebb903ccf2252b44391324571e78","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"85fd46ee26a11841c670449508025965f61ce131","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"},{"lessThan":"a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e","status":"affected","version":"f5778c398713692a16150ae96e5c8270bab8399f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B28CAC2A-4B06-4D07-8736-82E515099010","versionEndExcluding":"6.6.136","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path\n\nsmb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL\nand the default QUERY_INFO path.  The QUERY_INFO branch clamps\nqi.input_buffer_length to the server-reported OutputBufferLength and then\ncopies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but\nit never verifies that the flexible-array payload actually fits within\nrsp_iov[1].iov_len.\n\nA malicious server can return OutputBufferLength larger than the actual\nQUERY_INFO response, causing copy_to_user() to walk past the response\nbuffer and expose adjacent kernel heap to userspace.\n\nGuard the QUERY_INFO copy with a bounds check on the actual Buffer\npayload.  Use struct_size(qi_rsp, Buffer, qi.input_buffer_length)\nrather than an open-coded addition so the guard cannot overflow on\n32-bit builds."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: corregir lectura fuera de límites en la ruta QUERY_INFO de smb2_ioctl_query_info\n\nsmb2_ioctl_query_info() tiene dos ramas de copia de respuesta: PASSTHRU_FSCTL y la ruta QUERY_INFO predeterminada. La rama QUERY_INFO limita qi.input_buffer_length a la OutputBufferLength reportada por el servidor y luego copia qi.input_buffer_length bytes de qi_rsp  ->  Buffer al espacio de usuario, pero nunca verifica que la carga útil del array flexible realmente quepa dentro de rsp_iov[1].iov_len.\n\nUn servidor malicioso puede devolver una OutputBufferLength mayor que la respuesta QUERY_INFO real, haciendo que copy_to_user() se desplace más allá del búfer de respuesta y exponga el heap adyacente del kernel al espacio de usuario.\n\nProteger la copia QUERY_INFO con una comprobación de límites en la carga útil real del Buffer. Usar struct_size(qi_rsp, Buffer, qi.input_buffer_length) en lugar de una adición codificada abiertamente para que la protección no pueda desbordarse en compilaciones de 32 bits."}],"id":"CVE-2026-31708","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:45.456025Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:20.837","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/078fae8f50adebb903ccf2252b44391324571e78"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1dd757379997b71a328a4b591ffaf481acd0ead1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/85fd46ee26a11841c670449508025965f61ce131"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e203dbb5402897c43130fb171a2617008a91f45"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a34d456934fe42e4da5d2cc07787bf418bee99c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac2f14e4705d020f04e806efa0d49ab8dc2b145f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e66bdc0704977ecee667a81d38255b579c2353d0"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31709.json b/data/2026/CVE-2026-31709.json
index c2d9379f85..1f03fc043a 100644
--- a/data/2026/CVE-2026-31709.json
+++ b/data/2026/CVE-2026-31709.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b8603d9ae6c9087662b098619996bc4a8064319d","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"c2abdebf72000a64603ced84d36ccbd164f11391","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"d92f3f0b22414e7515696a02224d0af55e3004a3","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"b78db9bddc84136f6a0bb49e8883cf200dfb87a8","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"0a8cf165566ba55a39fd0f4de172119dd646d39a","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.86","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.20.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.77.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.126.1.rt7.467.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.126.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.12.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.174.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.174.1.rt14.459.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.129.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.119.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"57E416E8-C706-4061-8BC1-7C61879FD612","versionEndExcluding":"7.0.2","versionStartIncluding":"5.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate the whole DACL before rewriting it in cifsacl\n\nbuild_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a\nserver-supplied dacloffset and then use the incoming ACL to rebuild the\nchmod/chown security descriptor.\n\nThe original fix only checked that the struct smb_acl header fits before\nreading dacl_ptr->size or dacl_ptr->num_aces.  That avoids the immediate\nheader-field OOB read, but the rewrite helpers still walk ACEs based on\npdacl->num_aces with no structural validation of the incoming DACL body.\n\nA malicious server can return a truncated DACL that still contains a\nheader, claims one or more ACEs, and then drive\nreplace_sids_and_copy_aces() or set_chmod_dacl() past the validated\nextent while they compare or copy attacker-controlled ACEs.\n\nFactor the DACL structural checks into validate_dacl(), extend them to\nvalidate each ACE against the DACL bounds, and use the shared validator\nbefore the chmod/chown rebuild paths.  parse_dacl() reuses the same\nvalidator so the read-side parser and write-side rewrite paths agree on\nwhat constitutes a well-formed incoming DACL."}],"id":"CVE-2026-31709","lastModified":"2026-10-19T20:17:56.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:47.844968Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:20.950","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21556"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21706"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21745"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22900"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22940"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23224"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23237"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23329"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24343"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31709"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464476"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-1288"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b8603d9ae6c9087662b098619996bc4a8064319d","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"c2abdebf72000a64603ced84d36ccbd164f11391","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"d92f3f0b22414e7515696a02224d0af55e3004a3","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"b78db9bddc84136f6a0bb49e8883cf200dfb87a8","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"},{"lessThan":"0a8cf165566ba55a39fd0f4de172119dd646d39a","status":"affected","version":"bc3e9dd9d104ca1b75644eab87b38ce8a924aef4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.86","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.20.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.77.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.126.1.rt7.467.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.126.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.12.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.174.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.174.1.rt14.459.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.129.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.119.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"57E416E8-C706-4061-8BC1-7C61879FD612","versionEndExcluding":"7.0.2","versionStartIncluding":"5.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate the whole DACL before rewriting it in cifsacl\n\nbuild_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a\nserver-supplied dacloffset and then use the incoming ACL to rebuild the\nchmod/chown security descriptor.\n\nThe original fix only checked that the struct smb_acl header fits before\nreading dacl_ptr->size or dacl_ptr->num_aces.  That avoids the immediate\nheader-field OOB read, but the rewrite helpers still walk ACEs based on\npdacl->num_aces with no structural validation of the incoming DACL body.\n\nA malicious server can return a truncated DACL that still contains a\nheader, claims one or more ACEs, and then drive\nreplace_sids_and_copy_aces() or set_chmod_dacl() past the validated\nextent while they compare or copy attacker-controlled ACEs.\n\nFactor the DACL structural checks into validate_dacl(), extend them to\nvalidate each ACE against the DACL bounds, and use the shared validator\nbefore the chmod/chown rebuild paths.  parse_dacl() reuses the same\nvalidator so the read-side parser and write-side rewrite paths agree on\nwhat constitutes a well-formed incoming DACL."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: validar todo el DACL antes de reescribirlo en cifsacl\n\nbuild_sec_desc() e id_mode_to_cifs_acl() derivan un puntero DACL de un dacloffset proporcionado por el servidor y luego usan el ACL entrante para reconstruir el descriptor de seguridad chmod/chown.\n\nLa corrección original solo verificaba que el encabezado de la estructura smb_acl encajara antes de leer dacl_ptr  ->  size o dacl_ptr  ->  num_aces. Eso evita la lectura OOB inmediata del campo de encabezado, pero los ayudantes de reescritura aún recorren los ACE basándose en pdacl  ->  num_aces sin validación estructural del cuerpo del DACL entrante.\n\nUn servidor malicioso puede devolver un DACL truncado que aún contiene un encabezado, reclama uno o más ACE, y luego impulsa replace_sids_and_copy_aces() o set_chmod_dacl() más allá del alcance validado mientras comparan o copian ACE controlados por el atacante.\n\nFactorizar las comprobaciones estructurales del DACL en validate_dacl(), extenderlas para validar cada ACE contra los límites del DACL, y usar el validador compartido antes de las rutas de reconstrucción de chmod/chown. parse_dacl() reutiliza el mismo validador para que el analizador del lado de lectura y las rutas de reescritura del lado de escritura estén de acuerdo sobre lo que constituye un DACL entrante bien formado."}],"id":"CVE-2026-31709","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:47.844968Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:20.950","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a8cf165566ba55a39fd0f4de172119dd646d39a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8e47d297e7cf9a6029a0d38e7b22faba7d7aaf12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b78db9bddc84136f6a0bb49e8883cf200dfb87a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b8603d9ae6c9087662b098619996bc4a8064319d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c2abdebf72000a64603ced84d36ccbd164f11391"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d92f3f0b22414e7515696a02224d0af55e3004a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ff0ca46b13b9ef6edbcd238a3b6caacfef8ba0e5"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21556"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21706"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21745"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22900"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22940"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23224"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23237"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23329"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24343"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31709"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464476"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31709.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-1288"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31710.json b/data/2026/CVE-2026-31710.json
index 3091f0a6bb..c16d009c0a 100644
--- a/data/2026/CVE-2026-31710.json
+++ b/data/2026/CVE-2026-31710.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/connect.c","fs/smb/client/smb1ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbbfcf35e1ee3396631f3dc6214cb626aa9814c3","status":"affected","version":"4fc3a433c13944ee5766ec5b9bf6f1eb4d29b880","versionType":"git"},{"lessThan":"c4d3fc5844d685441befd0caaab648321013cdfd","status":"affected","version":"4fc3a433c13944ee5766ec5b9bf6f1eb4d29b880","versionType":"git"},{"status":"affected","version":"9d9f6e06123001208cd8ae6332c7e814ab709169","versionType":"git"},{"lessThan":"6.19","status":"affected","version":"6.18.53","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/connect.c","fs/smb/client/smb1ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"892296EC-C52B-40F8-9C2B-E023C2B6B4C6","versionEndExcluding":"7.0.2","versionStartIncluding":"7.0.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:*","matchCriteriaId":"EF897730-3F1E-47A2-8B07-22535202C487","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix dir separator in SMB1 UNIX mounts\n\nWhen calling cifs_mount_get_tcon() with SMB1 UNIX mounts,\n@cifs_sb->mnt_cifs_flags needs to be read or updated only after\ncalling reset_cifs_unix_caps(), otherwise it might end up with missing\nCIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits.\n\nThis fixes the wrong dir separator used in paths caused by the missing\nCIFS_MOUNT_POSIX_PATHS bit in cifs_sb_info::mnt_cifs_flags."}],"id":"CVE-2026-31710","lastModified":"2026-09-21T14:17:15.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:21.040","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4d3fc5844d685441befd0caaab648321013cdfd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbbfcf35e1ee3396631f3dc6214cb626aa9814c3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/connect.c","fs/smb/client/smb1ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbbfcf35e1ee3396631f3dc6214cb626aa9814c3","status":"affected","version":"4fc3a433c13944ee5766ec5b9bf6f1eb4d29b880","versionType":"git"},{"lessThan":"c4d3fc5844d685441befd0caaab648321013cdfd","status":"affected","version":"4fc3a433c13944ee5766ec5b9bf6f1eb4d29b880","versionType":"git"},{"status":"affected","version":"9d9f6e06123001208cd8ae6332c7e814ab709169","versionType":"git"},{"lessThan":"6.19","status":"affected","version":"6.18.53","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/connect.c","fs/smb/client/smb1ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"892296EC-C52B-40F8-9C2B-E023C2B6B4C6","versionEndExcluding":"7.0.2","versionStartIncluding":"7.0.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:*","matchCriteriaId":"EF897730-3F1E-47A2-8B07-22535202C487","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix dir separator in SMB1 UNIX mounts\n\nWhen calling cifs_mount_get_tcon() with SMB1 UNIX mounts,\n@cifs_sb->mnt_cifs_flags needs to be read or updated only after\ncalling reset_cifs_unix_caps(), otherwise it might end up with missing\nCIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits.\n\nThis fixes the wrong dir separator used in paths caused by the missing\nCIFS_MOUNT_POSIX_PATHS bit in cifs_sb_info::mnt_cifs_flags."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: corregir el separador de directorios en montajes SMB1 UNIX\n\nAl llamar a cifs_mount_get_tcon() con montajes SMB1 UNIX, @cifs_sb  ->  mnt_cifs_flags necesita ser leído o actualizado solo después de llamar a reset_cifs_unix_caps(), de lo contrario, podría terminar con la falta de los bits CIFS_MOUNT_POSIXACL y CIFS_MOUNT_POSIX_PATHS.\n\nEsto corrige el separador de directorios incorrecto utilizado en las rutas causado por la falta del bit CIFS_MOUNT_POSIX_PATHS en cifs_sb_info::mnt_cifs_flags."}],"id":"CVE-2026-31710","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:21.040","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4d3fc5844d685441befd0caaab648321013cdfd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbbfcf35e1ee3396631f3dc6214cb626aa9814c3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31711.json b/data/2026/CVE-2026-31711.json
index 5fe3bee1f0..10daf09bab 100644
--- a/data/2026/CVE-2026-31711.json
+++ b/data/2026/CVE-2026-31711.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dc2e7d595d68cf1be1ba64e3d30ebf3266bf7242","status":"affected","version":"4210c3555db4b38bade92331b153e583261f05f9","versionType":"git"},{"lessThan":"60734c8bc3b4aa0672e251f08dda81977e4b5387","status":"affected","version":"d5d7847e57ac69fa99c18b363a34419bcdb5a281","versionType":"git"},{"lessThan":"97f8d2648ef4871e4cd335e2d769cb40054a6772","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"295a9fc6789d1011c36ded9f0f2907bb34fa0de4","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"283027aa93380380a0994f35dde3ec95318f2654","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"fb48185bcd946d42de7017cf27f912f8ab26acf0","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"6551300dc452ac16a855a83dbd1e74899542d3b3","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"5.15.210","status":"affected","version":"5.15.91","versionType":"semver"},{"lessThan":"6.1.175","status":"affected","version":"6.1.9","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED68583F-E9BC-4090-BF89-17DA58537455","versionEndExcluding":"5.16","versionStartIncluding":"5.15.91","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"64423FA1-5CBD-4C54-B021-9A38E16861A1","versionEndExcluding":"6.2","versionStartIncluding":"6.1.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F9B6E58F-A6C7-42EF-B789-FD0BB75AA71A","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*","matchCriteriaId":"4AB8D555-648E-4F2F-98BD-3E7F45BD12A8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*","matchCriteriaId":"C64BDD9D-C663-4E75-AE06-356EDC392B82","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc8:*:*:*:*:*:*","matchCriteriaId":"26544390-88E4-41CA-98BF-7BB1E9D4E243","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: fix active_num_conn leak on transport allocation failure\n\nCommit 77ffbcac4e56 (\"smb: server: fix leak of active_num_conn in\nksmbd_tcp_new_connection()\") addressed the kthread_run() failure\npath.  The earlier alloc_transport() == NULL path in the same\nfunction has the same leak, is reachable pre-authentication via any\nTCP connect to port 445, and was empirically reproduced on UML\n(ARCH=um, v7.0-rc7): a small number of forced allocation failures\nwere sufficient to put ksmbd into a state where every subsequent\nconnection attempt was rejected for the remainder of the boot.\n\nksmbd_kthread_fn() increments active_num_conn before calling\nksmbd_tcp_new_connection() and discards the return value, so when\nalloc_transport() returns NULL the socket is released and -ENOMEM\nreturned without decrementing the counter.  Each such failure\npermanently consumes one slot from the max_connections pool; once\ncumulative failures reach the cap, atomic_inc_return() hits the\nthreshold on every subsequent accept and every new connection is\nrejected.  The counter is only reset by module reload.\n\nAn unauthenticated remote attacker can drive the server toward the\nmemory pressure that makes alloc_transport() fail by holding open\nconnections with large RFC1002 lengths up to MAX_STREAM_PROT_LEN\n(0x00FFFFFF); natural transient allocation failures on a loaded\nhost produce the same drift more slowly.\n\nMirror the existing rollback pattern in ksmbd_kthread_fn(): on the\nalloc_transport() failure path, decrement active_num_conn gated on\nserver_conf.max_connections.\n\nRepro details: with the patch reverted, forced alloc_transport()\nNULL returns leaked counter slots and subsequent connection\nattempts -- including legitimate connects issued after the\nforced-fail window had closed -- were all rejected with \"Limit the\nmaximum number of connections\".  With this patch applied, the same\nconnect sequence produces no rejections and the counter cycles\ncleanly between zero and one on every accept."}],"id":"CVE-2026-31711","lastModified":"2026-10-15T02:19:19.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.150","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/283027aa93380380a0994f35dde3ec95318f2654"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/295a9fc6789d1011c36ded9f0f2907bb34fa0de4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/60734c8bc3b4aa0672e251f08dda81977e4b5387"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6551300dc452ac16a855a83dbd1e74899542d3b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/97f8d2648ef4871e4cd335e2d769cb40054a6772"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dc2e7d595d68cf1be1ba64e3d30ebf3266bf7242"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb48185bcd946d42de7017cf27f912f8ab26acf0"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dc2e7d595d68cf1be1ba64e3d30ebf3266bf7242","status":"affected","version":"4210c3555db4b38bade92331b153e583261f05f9","versionType":"git"},{"lessThan":"60734c8bc3b4aa0672e251f08dda81977e4b5387","status":"affected","version":"d5d7847e57ac69fa99c18b363a34419bcdb5a281","versionType":"git"},{"lessThan":"97f8d2648ef4871e4cd335e2d769cb40054a6772","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"295a9fc6789d1011c36ded9f0f2907bb34fa0de4","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"283027aa93380380a0994f35dde3ec95318f2654","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"fb48185bcd946d42de7017cf27f912f8ab26acf0","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"6551300dc452ac16a855a83dbd1e74899542d3b3","status":"affected","version":"0d0d4680db22eda1eea785c47bbf66a9b33a8b16","versionType":"git"},{"lessThan":"5.15.210","status":"affected","version":"5.15.91","versionType":"semver"},{"lessThan":"6.1.175","status":"affected","version":"6.1.9","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED68583F-E9BC-4090-BF89-17DA58537455","versionEndExcluding":"5.16","versionStartIncluding":"5.15.91","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"64423FA1-5CBD-4C54-B021-9A38E16861A1","versionEndExcluding":"6.2","versionStartIncluding":"6.1.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F9B6E58F-A6C7-42EF-B789-FD0BB75AA71A","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*","matchCriteriaId":"4AB8D555-648E-4F2F-98BD-3E7F45BD12A8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*","matchCriteriaId":"C64BDD9D-C663-4E75-AE06-356EDC392B82","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc8:*:*:*:*:*:*","matchCriteriaId":"26544390-88E4-41CA-98BF-7BB1E9D4E243","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: fix active_num_conn leak on transport allocation failure\n\nCommit 77ffbcac4e56 (\"smb: server: fix leak of active_num_conn in\nksmbd_tcp_new_connection()\") addressed the kthread_run() failure\npath.  The earlier alloc_transport() == NULL path in the same\nfunction has the same leak, is reachable pre-authentication via any\nTCP connect to port 445, and was empirically reproduced on UML\n(ARCH=um, v7.0-rc7): a small number of forced allocation failures\nwere sufficient to put ksmbd into a state where every subsequent\nconnection attempt was rejected for the remainder of the boot.\n\nksmbd_kthread_fn() increments active_num_conn before calling\nksmbd_tcp_new_connection() and discards the return value, so when\nalloc_transport() returns NULL the socket is released and -ENOMEM\nreturned without decrementing the counter.  Each such failure\npermanently consumes one slot from the max_connections pool; once\ncumulative failures reach the cap, atomic_inc_return() hits the\nthreshold on every subsequent accept and every new connection is\nrejected.  The counter is only reset by module reload.\n\nAn unauthenticated remote attacker can drive the server toward the\nmemory pressure that makes alloc_transport() fail by holding open\nconnections with large RFC1002 lengths up to MAX_STREAM_PROT_LEN\n(0x00FFFFFF); natural transient allocation failures on a loaded\nhost produce the same drift more slowly.\n\nMirror the existing rollback pattern in ksmbd_kthread_fn(): on the\nalloc_transport() failure path, decrement active_num_conn gated on\nserver_conf.max_connections.\n\nRepro details: with the patch reverted, forced alloc_transport()\nNULL returns leaked counter slots and subsequent connection\nattempts -- including legitimate connects issued after the\nforced-fail window had closed -- were all rejected with \"Limit the\nmaximum number of connections\".  With this patch applied, the same\nconnect sequence produces no rejections and the counter cycles\ncleanly between zero and one on every accept."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: servidor: corrige la fuga de active_num_conn en el fallo de asignación de transporte\n\nEl commit 77ffbcac4e56 (’smb: servidor: corrige la fuga de active_num_conn en ksmbd_tcp_new_connection()’) abordó la ruta de fallo de kthread_run(). La ruta anterior alloc_transport() == NULL en la misma función tiene la misma fuga, es alcanzable pre-autenticación a través de cualquier conexión TCP al puerto 445, y fue reproducida empíricamente en UML (ARCH=um, v7.0-rc7): un pequeño número de fallos de asignación forzados fueron suficientes para poner a ksmbd en un estado donde cada intento de conexión subsiguiente fue rechazado por el resto del arranque.\n\nksmbd_kthread_fn() incrementa active_num_conn antes de llamar a ksmbd_tcp_new_connection() y descarta el valor de retorno, así que cuando alloc_transport() devuelve NULL el socket es liberado y -ENOMEM es devuelto sin decrementar el contador. Cada fallo de este tipo consume permanentemente una ranura del pool de max_connections; una vez que los fallos acumulativos alcanzan el límite, atomic_inc_return() alcanza el umbral en cada aceptación subsiguiente y cada nueva conexión es rechazada. El contador solo se reinicia al recargar el módulo.\n\nUn atacante remoto no autenticado puede llevar al servidor hacia la presión de memoria que hace que alloc_transport() falle manteniendo conexiones abiertas con grandes longitudes RFC1002 hasta MAX_STREAM_PROT_LEN (0x 00FFFFFF); los fallos de asignación transitorios naturales en un host cargado producen la misma deriva más lentamente.\n\nRefleja el patrón de reversión existente en ksmbd_kthread_fn(): en la ruta de fallo de alloc_transport(), decrementa active_num_conn limitado por server_conf.max_connections.\n\nDetalles de reproducción: con el parche revertido, los retornos NULL forzados de alloc_transport() filtraron ranuras de contador y los intentos de conexión subsiguientes --incluyendo conexiones legítimas emitidas después de que la ventana de fallo forzado se había cerrado-- fueron todos rechazados con ’Limite el número máximo de conexiones’. Con este parche aplicado, la misma secuencia de conexión no produce rechazos y el contador cicla limpiamente entre cero y uno en cada aceptación."}],"id":"CVE-2026-31711","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.150","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/283027aa93380380a0994f35dde3ec95318f2654"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/295a9fc6789d1011c36ded9f0f2907bb34fa0de4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/60734c8bc3b4aa0672e251f08dda81977e4b5387"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6551300dc452ac16a855a83dbd1e74899542d3b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/97f8d2648ef4871e4cd335e2d769cb40054a6772"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dc2e7d595d68cf1be1ba64e3d30ebf3266bf7242"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb48185bcd946d42de7017cf27f912f8ab26acf0"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31712.json b/data/2026/CVE-2026-31712.json
index 0097c3a6d0..9c5137297f 100644
--- a/data/2026/CVE-2026-31712.json
+++ b/data/2026/CVE-2026-31712.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"282cbbb476b9f35793452bc461934af4c7eca169","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"f20adc4ef7428bc485ee83fd1a592252fb87718b","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"325d4ac11f526cb8964cff14548ccf02d8c756d8","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"90089584b2e25c4510b7b987387b4405f0673ece","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"151b1799861fde38087c08f613abc2843ef597b0","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"d07b26f39246a82399661936dd0c853983cfade7","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04651641-C387-4546-B02F-17BA989CC253","versionEndExcluding":"6.12.84","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require minimum ACE size in smb_check_perm_dacl()\n\nBoth ACE-walk loops in smb_check_perm_dacl() only guard against an\nunder-sized remaining buffer, not against an ACE whose declared\n`ace->size` is smaller than the struct it claims to describe:\n\n  if (offsetof(struct smb_ace, access_req) > aces_size)\n      break;\n  ace_size = le16_to_cpu(ace->size);\n  if (ace_size > aces_size)\n      break;\n\nThe first check only requires the 4-byte ACE header to be in bounds;\nit does not require access_req (4 bytes at offset 4) to be readable.\nAn attacker who has set a crafted DACL on a file they own can declare\nace->size == 4 with aces_size == 4, pass both checks, and then\n\n  granted |= le32_to_cpu(ace->access_req);               /* upper loop */\n  compare_sids(&sid, &ace->sid);                         /* lower loop */\n\nreads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at\noffset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES\n* 4 bytes).\n\nTighten both loops to require\n\n  ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE\n\nwhich is the smallest valid on-wire ACE layout (4-byte header +\n4-byte access_req + 8-byte sid base with zero sub-auths).  Also\nreject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES\nbefore letting compare_sids() dereference sub_auth[] entries.\n\nparse_sec_desc() already enforces an equivalent check (lines 441-448);\nsmb_check_perm_dacl() simply grew weaker validation over time.\n\nReachability: authenticated SMB client with permission to set an ACL\non a file.  On a subsequent CREATE against that file, the kernel\nwalks the stored DACL via smb_check_perm_dacl() and triggers the\nOOB read.  Not pre-auth, and the OOB read is not reflected to the\nattacker, but KASAN reports and kernel state corruption are\npossible."}],"id":"CVE-2026-31712","lastModified":"2026-10-15T02:19:19.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.270","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/151b1799861fde38087c08f613abc2843ef597b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/282cbbb476b9f35793452bc461934af4c7eca169"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/325d4ac11f526cb8964cff14548ccf02d8c756d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/90089584b2e25c4510b7b987387b4405f0673ece"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d07b26f39246a82399661936dd0c853983cfade7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f20adc4ef7428bc485ee83fd1a592252fb87718b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"282cbbb476b9f35793452bc461934af4c7eca169","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"f20adc4ef7428bc485ee83fd1a592252fb87718b","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"325d4ac11f526cb8964cff14548ccf02d8c756d8","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"90089584b2e25c4510b7b987387b4405f0673ece","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"151b1799861fde38087c08f613abc2843ef597b0","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"d07b26f39246a82399661936dd0c853983cfade7","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04651641-C387-4546-B02F-17BA989CC253","versionEndExcluding":"6.12.84","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require minimum ACE size in smb_check_perm_dacl()\n\nBoth ACE-walk loops in smb_check_perm_dacl() only guard against an\nunder-sized remaining buffer, not against an ACE whose declared\n`ace->size` is smaller than the struct it claims to describe:\n\n  if (offsetof(struct smb_ace, access_req) > aces_size)\n      break;\n  ace_size = le16_to_cpu(ace->size);\n  if (ace_size > aces_size)\n      break;\n\nThe first check only requires the 4-byte ACE header to be in bounds;\nit does not require access_req (4 bytes at offset 4) to be readable.\nAn attacker who has set a crafted DACL on a file they own can declare\nace->size == 4 with aces_size == 4, pass both checks, and then\n\n  granted |= le32_to_cpu(ace->access_req);               /* upper loop */\n  compare_sids(&sid, &ace->sid);                         /* lower loop */\n\nreads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at\noffset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES\n* 4 bytes).\n\nTighten both loops to require\n\n  ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE\n\nwhich is the smallest valid on-wire ACE layout (4-byte header +\n4-byte access_req + 8-byte sid base with zero sub-auths).  Also\nreject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES\nbefore letting compare_sids() dereference sub_auth[] entries.\n\nparse_sec_desc() already enforces an equivalent check (lines 441-448);\nsmb_check_perm_dacl() simply grew weaker validation over time.\n\nReachability: authenticated SMB client with permission to set an ACL\non a file.  On a subsequent CREATE against that file, the kernel\nwalks the stored DACL via smb_check_perm_dacl() and triggers the\nOOB read.  Not pre-auth, and the OOB read is not reflected to the\nattacker, but KASAN reports and kernel state corruption are\npossible."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nksmbd: requerir tamaño mínimo de ACE en smb_check_perm_dacl()\n\nAmbos bucles de recorrido de ACE en smb_check_perm_dacl() solo protegen contra un búfer restante de tamaño insuficiente, no contra un ACE cuyo ’ace  ->  size’ declarado es más pequeño que la estructura que afirma describir:\n\n  if (offsetof(struct smb_ace, access_req) > aces_size)\n      break;\n  ace_size = le16_to_cpu(ace  ->  size);\n  if (ace_size > aces_size)\n      break;\n\nLa primera comprobación solo requiere que el encabezado ACE de 4 bytes esté dentro de los límites; no requiere que access_req (4 bytes en el desplazamiento 4) sea legible. Un atacante que ha establecido un DACL manipulado en un archivo de su propiedad puede declarar ace  ->  size == 4 con aces_size == 4, pasar ambas comprobaciones y luego\n\n  granted |= le32_to_cpu(ace  ->  access_req);               /* upper loop */\n  compare_sids(&sid, &ace  ->  sid);                         /* lower loop */\n\nlee access_req en el desplazamiento 4 (fuera de límites por hasta 4 bytes) y ace  ->  sid en el desplazamiento 8 (fuera de límites por hasta CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES * 4 bytes).\n\nAjustar ambos bucles para requerir\n\n  ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE\n\nque es el diseño de ACE en la red más pequeño y válido (encabezado de 4 bytes + access_req de 4 bytes + base sid de 8 bytes con cero sub-autoridades). También rechazar ACEs cuyo sid.num_subauth excede SID_MAX_SUB_AUTHORITIES antes de permitir que compare_sids() desreferencie las entradas de sub_auth[].\n\nparse_sec_desc() ya aplica una comprobación equivalente (líneas 441-448); smb_check_perm_dacl() simplemente desarrolló una validación más débil con el tiempo.\n\nAlcanzabilidad: cliente SMB autenticado con permiso para establecer una ACL en un archivo. En un CREATE posterior contra ese archivo, el kernel recorre el DACL almacenado a través de smb_check_perm_dacl() y desencadena la lectura fuera de límites (OOB). No es pre-autenticación, y la lectura fuera de límites (OOB) no se refleja al atacante, pero los informes de KASAN y la corrupción del estado del kernel son posibles."}],"id":"CVE-2026-31712","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.270","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/151b1799861fde38087c08f613abc2843ef597b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/282cbbb476b9f35793452bc461934af4c7eca169"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/325d4ac11f526cb8964cff14548ccf02d8c756d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/90089584b2e25c4510b7b987387b4405f0673ece"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95e5aa3c3261da8c95b27d7aecf8ee39b9f86a4c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d07b26f39246a82399661936dd0c853983cfade7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f20adc4ef7428bc485ee83fd1a592252fb87718b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31714.json b/data/2026/CVE-2026-31714.json
index 05a120756e..f311c16073 100644
--- a/data/2026/CVE-2026-31714.json
+++ b/data/2026/CVE-2026-31714.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a76c1cad4e80a9802ef8048662255417e3ce5b79","status":"affected","version":"7525dec4b34c80b3015c3f2ac143fd2bfc1febc3","versionType":"git"},{"lessThan":"c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e","status":"affected","version":"40b2d55e045222dd6de2a54a299f682e0f954b03","versionType":"git"},{"lessThan":"047c0aef6af37a2a35181aa085c616ad286386f1","status":"affected","version":"40b2d55e045222dd6de2a54a299f682e0f954b03","versionType":"git"},{"lessThan":"369eb2016d8e2f01931b3bad1cb9cefa83f44003","status":"affected","version":"40b2d55e045222dd6de2a54a299f682e0f954b03","versionType":"git"},{"lessThan":"3cf11e6f36c170050c12171dd6fd3142711478fc","status":"affected","version":"40b2d55e045222dd6de2a54a299f682e0f954b03","versionType":"git"},{"status":"affected","version":"1d1b89c9846e6a550eca3d2ce9323fb591e4f321","versionType":"git"},{"status":"affected","version":"64582cc5357cd984724cfb0835b4a34d9c279d31","versionType":"git"},{"lessThan":"6.6.136","status":"affected","version":"6.6.23","versionType":"semver"},{"lessThan":"6.8","status":"affected","version":"6.7.11","versionType":"semver"},{"lessThan":"6.9","status":"affected","version":"6.8.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"99A74472-B9EF-4BEF-A3D3-C4A49B46D936","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6.23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CD8383BB-B294-4F4D-996D-A780685E6362","versionEndExcluding":"6.8","versionStartIncluding":"6.7.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9076253-5796-4E04-9AB4-42087B5524F4","versionEndExcluding":"6.9","versionStartIncluding":"6.8.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E8C01EA7-003E-4236-9C2D-0C2322FB0CE3","versionEndExcluding":"6.12.84","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid memory leak in f2fs_rename()\n\nsyzbot reported a f2fs bug as below:\n\nBUG: memory leak\nunreferenced object 0xffff888127f70830 (size 16):\n  comm \"syz.0.23\", pid 6144, jiffies 4294943712\n  hex dump (first 16 bytes):\n    3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff  <.Wr[...n..3B9..\n  backtrace (crc 925f8a80):\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n    slab_post_alloc_hook mm/slub.c:4520 [inline]\n    slab_alloc_node mm/slub.c:4844 [inline]\n    __do_kmalloc_node mm/slub.c:5237 [inline]\n    __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250\n    kmalloc_noprof include/linux/slab.h:954 [inline]\n    fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364\n    f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143\n    f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961\n    f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308\n    vfs_rename+0x7ff/0x1250 fs/namei.c:6026\n    filename_renameat2+0x4f4/0x660 fs/namei.c:6144\n    __do_sys_renameat2 fs/namei.c:6173 [inline]\n    __se_sys_renameat2 fs/namei.c:6168 [inline]\n    __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is in commit 40b2d55e0452 (\"f2fs: fix to create selinux\nlabel during whiteout initialization\"), we added a call to\nf2fs_setup_filename() without a matching call to f2fs_free_filename(),\nfix it."}],"id":"CVE-2026-31714","lastModified":"2026-06-17T10:34:17.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:21.493","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/047c0aef6af37a2a35181aa085c616ad286386f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/369eb2016d8e2f01931b3bad1cb9cefa83f44003"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cf11e6f36c170050c12171dd6fd3142711478fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a76c1cad4e80a9802ef8048662255417e3ce5b79"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a76c1cad4e80a9802ef8048662255417e3ce5b79","status":"affected","version":"7525dec4b34c80b3015c3f2ac143fd2bfc1febc3","versionType":"git"},{"lessThan":"c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e","status":"affected","version":"40b2d55e045222dd6de2a54a299f682e0f954b03","versionType":"git"},{"lessThan":"047c0aef6af37a2a35181aa085c616ad286386f1","status":"affected","version":"40b2d55e045222dd6de2a54a299f682e0f954b03","versionType":"git"},{"lessThan":"369eb2016d8e2f01931b3bad1cb9cefa83f44003","status":"affected","version":"40b2d55e045222dd6de2a54a299f682e0f954b03","versionType":"git"},{"lessThan":"3cf11e6f36c170050c12171dd6fd3142711478fc","status":"affected","version":"40b2d55e045222dd6de2a54a299f682e0f954b03","versionType":"git"},{"status":"affected","version":"1d1b89c9846e6a550eca3d2ce9323fb591e4f321","versionType":"git"},{"status":"affected","version":"64582cc5357cd984724cfb0835b4a34d9c279d31","versionType":"git"},{"lessThan":"6.6.136","status":"affected","version":"6.6.23","versionType":"semver"},{"lessThan":"6.8","status":"affected","version":"6.7.11","versionType":"semver"},{"lessThan":"6.9","status":"affected","version":"6.8.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"99A74472-B9EF-4BEF-A3D3-C4A49B46D936","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6.23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CD8383BB-B294-4F4D-996D-A780685E6362","versionEndExcluding":"6.8","versionStartIncluding":"6.7.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9076253-5796-4E04-9AB4-42087B5524F4","versionEndExcluding":"6.9","versionStartIncluding":"6.8.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E8C01EA7-003E-4236-9C2D-0C2322FB0CE3","versionEndExcluding":"6.12.84","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid memory leak in f2fs_rename()\n\nsyzbot reported a f2fs bug as below:\n\nBUG: memory leak\nunreferenced object 0xffff888127f70830 (size 16):\n  comm \"syz.0.23\", pid 6144, jiffies 4294943712\n  hex dump (first 16 bytes):\n    3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff  <.Wr[...n..3B9..\n  backtrace (crc 925f8a80):\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n    slab_post_alloc_hook mm/slub.c:4520 [inline]\n    slab_alloc_node mm/slub.c:4844 [inline]\n    __do_kmalloc_node mm/slub.c:5237 [inline]\n    __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250\n    kmalloc_noprof include/linux/slab.h:954 [inline]\n    fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364\n    f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143\n    f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961\n    f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308\n    vfs_rename+0x7ff/0x1250 fs/namei.c:6026\n    filename_renameat2+0x4f4/0x660 fs/namei.c:6144\n    __do_sys_renameat2 fs/namei.c:6173 [inline]\n    __se_sys_renameat2 fs/namei.c:6168 [inline]\n    __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is in commit 40b2d55e0452 (\"f2fs: fix to create selinux\nlabel during whiteout initialization\"), we added a call to\nf2fs_setup_filename() without a matching call to f2fs_free_filename(),\nfix it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nf2fs: corrección para evitar una fuga de memoria en f2fs_rename()\n\nsyzbot informó un error de f2fs como se detalla a continuación:\n\nERROR: fuga de memoria\nobjeto sin referencia 0x ffff888127f70830 (tamaño 16):\n  comm ’syz.0.23’, pid 6144, jiffies 4294943712\n  volcado hexadecimal (primeros 16 bytes):\n    3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff  <.Wr[...n..3B9..\n  rastreo (crc 925f8a80):\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n    slab_post_alloc_hook mm/slub.c:4520 [inline]\n    slab_alloc_node mm/slub.c:4844 [inline]\n    __do_kmalloc_node mm/slub.c:5237 [inline]\n    __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250\n    kmalloc_noprof include/linux/slab.h:954 [inline]\n    fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364\n    f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143\n    f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961\n    f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308\n    vfs_rename+0x7ff/0x 1250 fs/namei.c:6026\n    filename_renameat2+0x4f4/0x660 fs/namei.c:6144\n    __do_sys_renameat2 fs/namei.c:6173 [inline]\n    __se_sys_renameat2 fs/namei.c:6168 [inline]\n    __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLa causa raíz se encuentra en el commit 40b2d55e0452 (’f2fs: corrección para crear etiqueta selinux durante la inicialización de whiteout’), añadimos una llamada a f2fs_setup_filename() sin una llamada correspondiente a f2fs_free_filename(), corregirlo."}],"id":"CVE-2026-31714","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:21.493","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/047c0aef6af37a2a35181aa085c616ad286386f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/369eb2016d8e2f01931b3bad1cb9cefa83f44003"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cf11e6f36c170050c12171dd6fd3142711478fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a76c1cad4e80a9802ef8048662255417e3ce5b79"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31715.json b/data/2026/CVE-2026-31715.json
index 5d70925f15..8b83ead5da 100644
--- a/data/2026/CVE-2026-31715.json
+++ b/data/2026/CVE-2026-31715.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/data.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7dbdab4430e4654db9aacef12b9b3b8b29ca25cb","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"ffb94770dbdfb5411be5d9f44a960b010ec890ad","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"0d40b26377f891e6dcb6efaf8ef9374c99be1b1d","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"1171f329cf1c175321251ac40fd126150d7ad1e8","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"7be222de96c0f9eee6e65eeb017ef855ee185cfa","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"963d2e24d9d92a31e6773b0f642214f10013ebf7","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"188bb65f247a7a7c62f287c9a263aee3cad96fa5","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/data.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.86","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8FCBD357-E27C-4208-8F7A-93061EE45D3E","versionEndExcluding":"6.18.25","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()\n\nThe xfstests case \"generic/107\" and syzbot have both reported a NULL\npointer dereference.\n\nThe concurrent scenario that triggers the panic is as follows:\n\nF2FS_WB_CP_DATA write callback          umount\n                                        - f2fs_write_checkpoint\n                                         - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA)\n- blk_mq_end_request\n - bio_endio\n  - f2fs_write_end_io\n   : dec_page_count(sbi, F2FS_WB_CP_DATA)\n   : wake_up(&sbi->cp_wait)\n                                        - kill_f2fs_super\n                                         - kill_block_super\n                                          - f2fs_put_super\n                                           : iput(sbi->node_inode)\n                                           : sbi->node_inode = NULL\n   : f2fs_in_warm_node_list\n    - is_node_folio // sbi->node_inode is NULL and panic\n\nThe root cause is that f2fs_put_super() calls iput(sbi->node_inode) and\nsets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is\ndecremented to zero. As a result, f2fs_in_warm_node_list() may\ndereference a NULL node_inode when checking whether a folio belongs to\nthe node inode, leading to a panic.\n\nThis patch fixes the issue by calling f2fs_in_warm_node_list() before\ndecrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the\nuse-after-free condition."}],"id":"CVE-2026-31715","lastModified":"2026-06-19T13:16:27.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:21.637","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d40b26377f891e6dcb6efaf8ef9374c99be1b1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1171f329cf1c175321251ac40fd126150d7ad1e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/188bb65f247a7a7c62f287c9a263aee3cad96fa5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7be222de96c0f9eee6e65eeb017ef855ee185cfa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7dbdab4430e4654db9aacef12b9b3b8b29ca25cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/963d2e24d9d92a31e6773b0f642214f10013ebf7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ffb94770dbdfb5411be5d9f44a960b010ec890ad"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/data.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7dbdab4430e4654db9aacef12b9b3b8b29ca25cb","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"ffb94770dbdfb5411be5d9f44a960b010ec890ad","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"0d40b26377f891e6dcb6efaf8ef9374c99be1b1d","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"1171f329cf1c175321251ac40fd126150d7ad1e8","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"7be222de96c0f9eee6e65eeb017ef855ee185cfa","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"963d2e24d9d92a31e6773b0f642214f10013ebf7","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"188bb65f247a7a7c62f287c9a263aee3cad96fa5","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"},{"lessThan":"2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53","status":"affected","version":"50fa53eccf9f911a5b435248a2b0bd484fd82e5e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/data.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.86","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8FCBD357-E27C-4208-8F7A-93061EE45D3E","versionEndExcluding":"6.18.25","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()\n\nThe xfstests case \"generic/107\" and syzbot have both reported a NULL\npointer dereference.\n\nThe concurrent scenario that triggers the panic is as follows:\n\nF2FS_WB_CP_DATA write callback          umount\n                                        - f2fs_write_checkpoint\n                                         - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA)\n- blk_mq_end_request\n - bio_endio\n  - f2fs_write_end_io\n   : dec_page_count(sbi, F2FS_WB_CP_DATA)\n   : wake_up(&sbi->cp_wait)\n                                        - kill_f2fs_super\n                                         - kill_block_super\n                                          - f2fs_put_super\n                                           : iput(sbi->node_inode)\n                                           : sbi->node_inode = NULL\n   : f2fs_in_warm_node_list\n    - is_node_folio // sbi->node_inode is NULL and panic\n\nThe root cause is that f2fs_put_super() calls iput(sbi->node_inode) and\nsets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is\ndecremented to zero. As a result, f2fs_in_warm_node_list() may\ndereference a NULL node_inode when checking whether a folio belongs to\nthe node inode, leading to a panic.\n\nThis patch fixes the issue by calling f2fs_in_warm_node_list() before\ndecrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the\nuse-after-free condition."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nf2fs: corrige UAF causada por la disminución de sbi  ->  nr_pages[] en f2fs_write_end_io()\n\nEl caso de xfstests ’generic/107’ y syzbot han reportado ambos una desreferencia de puntero NULL.\n\nEl escenario concurrente que desencadena el pánico es el siguiente:\n\nF2FS_WB_CP_DATA write callback          desmontar\n                                        - f2fs_write_checkpoint\n                                         - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA)\n- blk_mq_end_request\n - bio_endio\n  - f2fs_write_end_io\n   : dec_page_count(sbi, F2FS_WB_CP_DATA)\n   : wake_up(&sbi  ->  cp_wait)\n                                        - kill_f2fs_super\n                                         - kill_block_super\n                                          - f2fs_put_super\n                                           : iput(sbi  ->  node_inode)\n                                           : sbi  ->  node_inode = NULL\n   : f2fs_in_warm_node_list\n    - is_node_folio // sbi  ->  node_inode es NULL y pánico\n\nLa causa raíz es que f2fs_put_super() llama a iput(sbi  ->  node_inode) y establece sbi  ->  node_inode en NULL después de que sbi  ->  nr_pages[F2FS_WB_CP_DATA] se decrementa a cero. Como resultado, f2fs_in_warm_node_list() puede desreferenciar un node_inode NULL al verificar si un folio pertenece al nodo inode, lo que lleva a un pánico.\n\nEste parche corrige el problema llamando a f2fs_in_warm_node_list() antes de decrementar sbi  ->  nr_pages[F2FS_WB_CP_DATA], evitando así la condición de uso después de liberación."}],"id":"CVE-2026-31715","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T14:16:21.637","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d40b26377f891e6dcb6efaf8ef9374c99be1b1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1171f329cf1c175321251ac40fd126150d7ad1e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/188bb65f247a7a7c62f287c9a263aee3cad96fa5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7be222de96c0f9eee6e65eeb017ef855ee185cfa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7dbdab4430e4654db9aacef12b9b3b8b29ca25cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/963d2e24d9d92a31e6773b0f642214f10013ebf7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ffb94770dbdfb5411be5d9f44a960b010ec890ad"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31716.json b/data/2026/CVE-2026-31716.json
index bd61bf920f..7ec61452b8 100644
--- a/data/2026/CVE-2026-31716.json
+++ b/data/2026/CVE-2026-31716.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs3/fslog.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8e64d33198b5a0fb14a452708bad844f94f03b2c","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"1393a467a9607e62123806de7d4c3a3e54e396a9","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"f90b8a1798b750755a9e9aee66678f0a1820bbaf","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"4b1613d7e2deda831a97e427d1ea586e50fe1be5","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"0112e6279420d4005b3d57af36fb45c01b8d0116","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"f79d0403ea20a81bc29105bba54fbcab54e8c403","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"0ca0485e4b2e837ebb6cbd4f2451aba665a03e4b","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs3/fslog.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate rec->used in journal-replay file record check\n\ncheck_file_record() validates rec->total against the record size but\nnever validates rec->used.  The do_action() journal-replay handlers read\nrec->used from disk and use it to compute memmove lengths:\n\n  DeleteAttribute:    memmove(attr, ..., used - asize - roff)\n  CreateAttribute:    memmove(..., attr, used - roff)\n  change_attr_size:   memmove(..., used - PtrOffset(rec, next))\n\nWhen rec->used is smaller than the offset of a validated attribute, or\nlarger than the record size, these subtractions can underflow allowing\nus to copy huge amounts of memory in to a 4kb buffer, generally\nconsidered a bad idea overall.\n\nThis requires a corrupted filesystem, which isn't a threat model the\nkernel really needs to worry about, but checking for such an obvious\nout-of-bounds value is good to keep things robust, especially on journal\nreplay\n\nFix this up by bounding rec->used correctly.\n\nThis is much like commit b2bc7c44ed17 (\"fs/ntfs3: Fix slab-out-of-bounds\nread in DeleteIndexEntryRoot\") which checked different values in this\nsame switch statement."}],"id":"CVE-2026-31716","lastModified":"2026-06-17T10:34:17.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.743","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0112e6279420d4005b3d57af36fb45c01b8d0116"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0ca0485e4b2e837ebb6cbd4f2451aba665a03e4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1393a467a9607e62123806de7d4c3a3e54e396a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b1613d7e2deda831a97e427d1ea586e50fe1be5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8e64d33198b5a0fb14a452708bad844f94f03b2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f79d0403ea20a81bc29105bba54fbcab54e8c403"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f90b8a1798b750755a9e9aee66678f0a1820bbaf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs3/fslog.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8e64d33198b5a0fb14a452708bad844f94f03b2c","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"1393a467a9607e62123806de7d4c3a3e54e396a9","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"f90b8a1798b750755a9e9aee66678f0a1820bbaf","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"4b1613d7e2deda831a97e427d1ea586e50fe1be5","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"0112e6279420d4005b3d57af36fb45c01b8d0116","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"f79d0403ea20a81bc29105bba54fbcab54e8c403","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"},{"lessThan":"0ca0485e4b2e837ebb6cbd4f2451aba665a03e4b","status":"affected","version":"b46acd6a6a627d876898e1c84d3f84902264b445","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs3/fslog.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate rec->used in journal-replay file record check\n\ncheck_file_record() validates rec->total against the record size but\nnever validates rec->used.  The do_action() journal-replay handlers read\nrec->used from disk and use it to compute memmove lengths:\n\n  DeleteAttribute:    memmove(attr, ..., used - asize - roff)\n  CreateAttribute:    memmove(..., attr, used - roff)\n  change_attr_size:   memmove(..., used - PtrOffset(rec, next))\n\nWhen rec->used is smaller than the offset of a validated attribute, or\nlarger than the record size, these subtractions can underflow allowing\nus to copy huge amounts of memory in to a 4kb buffer, generally\nconsidered a bad idea overall.\n\nThis requires a corrupted filesystem, which isn't a threat model the\nkernel really needs to worry about, but checking for such an obvious\nout-of-bounds value is good to keep things robust, especially on journal\nreplay\n\nFix this up by bounding rec->used correctly.\n\nThis is much like commit b2bc7c44ed17 (\"fs/ntfs3: Fix slab-out-of-bounds\nread in DeleteIndexEntryRoot\") which checked different values in this\nsame switch statement."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs/ntfs3: validar rec  ->  used en la verificación de registro de archivo de reproducción de diario\n\ncheck_file_record() valida rec  ->  total contra el tamaño del registro pero nunca valida rec  ->  used. Los manejadores de reproducción de diario do_action() leen rec  ->  used del disco y lo usan para calcular las longitudes de memmove:\n\nDeleteAttribute: memmove(attr, ..., used - asize - roff)\nCreateAttribute: memmove(..., attr, used - roff)\nchange_attr_size: memmove(..., used - PtrOffset(rec, next))\n\nCuando rec  ->  used es menor que el desplazamiento de un atributo validado, o mayor que el tamaño del registro, estas restas pueden desbordarse por debajo, permitiéndonos copiar grandes cantidades de memoria en un búfer de 4kb, generalmente considerado una mala idea en general.\n\nEsto requiere un sistema de archivos corrupto, lo cual no es un modelo de amenaza del que el kernel realmente necesite preocuparse, pero verificar un valor tan obvio fuera de los límites es bueno para mantener la robustez, especialmente en la reproducción de diario.\n\nCorregir esto delimitando rec  ->  used correctamente.\n\nEsto es muy similar al commit b2bc7c44ed17 (’fs/ntfs3: Corregir lectura fuera de límites de slab en DeleteIndexEntryRoot’) que verificó diferentes valores en esta misma declaración switch."}],"id":"CVE-2026-31716","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.743","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0112e6279420d4005b3d57af36fb45c01b8d0116"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0ca0485e4b2e837ebb6cbd4f2451aba665a03e4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1393a467a9607e62123806de7d4c3a3e54e396a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b1613d7e2deda831a97e427d1ea586e50fe1be5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8e64d33198b5a0fb14a452708bad844f94f03b2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f79d0403ea20a81bc29105bba54fbcab54e8c403"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f90b8a1798b750755a9e9aee66678f0a1820bbaf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31717.json b/data/2026/CVE-2026-31717.json
index c537a48b14..07ccbeca8a 100644
--- a/data/2026/CVE-2026-31717.json
+++ b/data/2026/CVE-2026-31717.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/mgmt/user_session.c","fs/smb/server/oplock.c","fs/smb/server/oplock.h","fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"712cdf917e77a6444ce3836874829d770db20ee6","status":"affected","version":"8df4bcdb0a4232192b2445256c39b787d58ef14d","versionType":"git"},{"lessThan":"c7f0f0d01c88bdcb8b1694d7d321670013f7ed7d","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"00ce8d6789dae72d042a4522264964c72891ca37","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"c908c853f304a4969b5aa10eba0b50350cc65b80","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"49110a8ce654bbe56bef7c5e44cce31f4b102b8a","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"6.6.142","status":"affected","version":"6.6.32","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/mgmt/user_session.c","fs/smb/server/oplock.c","fs/smb/server/oplock.h","fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.142","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2C15E547-F33F-4337-A576-685C65C6D439","versionEndExcluding":"6.7","versionStartIncluding":"6.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FB3AD8C5-FEB3-4B8C-A314-EFD501361AE9","versionEndExcluding":"6.18.25","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate owner of durable handle on reconnect\n\nCurrently, ksmbd does not verify if the user attempting to reconnect\nto a durable handle is the same user who originally opened the file.\nThis allows any authenticated user to hijack an orphaned durable handle\nby predicting or brute-forcing the persistent ID.\n\nAccording to MS-SMB2, the server MUST verify that the SecurityContext\nof the reconnect request matches the SecurityContext associated with\nthe existing open.\nAdd a durable_owner structure to ksmbd_file to store the original opener's\nUID, GID, and account name. and catpure the owner information when a file\nhandle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner()\nto validate the identity of the requester during SMB2_CREATE (DHnC)."}],"id":"CVE-2026-31717","lastModified":"2026-06-17T10:34:18.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.860","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00ce8d6789dae72d042a4522264964c72891ca37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49110a8ce654bbe56bef7c5e44cce31f4b102b8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/712cdf917e77a6444ce3836874829d770db20ee6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c7f0f0d01c88bdcb8b1694d7d321670013f7ed7d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c908c853f304a4969b5aa10eba0b50350cc65b80"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/mgmt/user_session.c","fs/smb/server/oplock.c","fs/smb/server/oplock.h","fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"712cdf917e77a6444ce3836874829d770db20ee6","status":"affected","version":"8df4bcdb0a4232192b2445256c39b787d58ef14d","versionType":"git"},{"lessThan":"c7f0f0d01c88bdcb8b1694d7d321670013f7ed7d","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"00ce8d6789dae72d042a4522264964c72891ca37","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"c908c853f304a4969b5aa10eba0b50350cc65b80","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"49110a8ce654bbe56bef7c5e44cce31f4b102b8a","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"6.6.142","status":"affected","version":"6.6.32","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/mgmt/user_session.c","fs/smb/server/oplock.c","fs/smb/server/oplock.h","fs/smb/server/smb2pdu.c","fs/smb/server/vfs_cache.c","fs/smb/server/vfs_cache.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.142","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2C15E547-F33F-4337-A576-685C65C6D439","versionEndExcluding":"6.7","versionStartIncluding":"6.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FB3AD8C5-FEB3-4B8C-A314-EFD501361AE9","versionEndExcluding":"6.18.25","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate owner of durable handle on reconnect\n\nCurrently, ksmbd does not verify if the user attempting to reconnect\nto a durable handle is the same user who originally opened the file.\nThis allows any authenticated user to hijack an orphaned durable handle\nby predicting or brute-forcing the persistent ID.\n\nAccording to MS-SMB2, the server MUST verify that the SecurityContext\nof the reconnect request matches the SecurityContext associated with\nthe existing open.\nAdd a durable_owner structure to ksmbd_file to store the original opener's\nUID, GID, and account name. and catpure the owner information when a file\nhandle becomes orphaned. and implementing ksmbd_vfs_compare_durable_owner()\nto validate the identity of the requester during SMB2_CREATE (DHnC)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: validar el propietario del identificador duradero al reconectar\n\nActualmente, ksmbd no verifica si el usuario que intenta reconectar a un identificador duradero es el mismo usuario que abrió originalmente el archivo. Esto permite a cualquier usuario autenticado secuestrar un identificador duradero huérfano prediciendo o forzando por fuerza bruta el ID persistente.\n\nSegún MS-SMB2, el servidor DEBE verificar que el SecurityContext de la solicitud de reconexión coincide con el SecurityContext asociado con la apertura existente.\nAñadir una estructura durable_owner a ksmbd_file para almacenar el UID, GID y nombre de cuenta del abridor original. Y capturar la información del propietario cuando un identificador de archivo queda huérfano. E implementar ksmbd_vfs_compare_durable_owner() para validar la identidad del solicitante durante SMB2_CREATE (DHnC)."}],"id":"CVE-2026-31717","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.860","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00ce8d6789dae72d042a4522264964c72891ca37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49110a8ce654bbe56bef7c5e44cce31f4b102b8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/712cdf917e77a6444ce3836874829d770db20ee6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c7f0f0d01c88bdcb8b1694d7d321670013f7ed7d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c908c853f304a4969b5aa10eba0b50350cc65b80"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31718.json b/data/2026/CVE-2026-31718.json
index 0e3feaf8ea..86b9305d6c 100644
--- a/data/2026/CVE-2026-31718.json
+++ b/data/2026/CVE-2026-31718.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0000a7780e0e446a28a273572f6ea8f7f582f694","status":"affected","version":"8df4bcdb0a4232192b2445256c39b787d58ef14d","versionType":"git"},{"lessThan":"e33c65f011980b4ad4abfd93585ec2079856368f","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"3d6682726c2d3a46d31dae88b8166786b09b03ad","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"b34fc42cfe922e551f7a27d3ac3bb016e41d7dd9","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"235e32320a470fcd3998fb3774f2290a0eb302a1","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"6.6.140","status":"affected","version":"6.6.32","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2C15E547-F33F-4337-A576-685C65C6D439","versionEndExcluding":"6.7","versionStartIncluding":"6.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E8C01EA7-003E-4236-9C2D-0C2322FB0CE3","versionEndExcluding":"6.12.84","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger\n\nWhen a durable file handle survives session disconnect (TCP close without\nSMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the\nhandle for later reconnection. However, it did not clean up the byte-range\nlocks on fp->lock_list.\n\nLater, when the durable scavenger thread times out and calls\n__ksmbd_close_fd(NULL, fp), the lock cleanup loop did:\n\n    spin_lock(&fp->conn->llist_lock);\n\nThis caused a slab use-after-free because fp->conn was NULL and the\noriginal connection object had already been freed by\nksmbd_tcp_disconnect().\n\nThe root cause is asymmetric cleanup: lock entries (smb_lock->clist) were\nleft dangling on the freed conn->lock_list while fp->conn was nulled out.\n\nTo fix this issue properly, we need to handle the lifetime of\nsmb_lock->clist across three paths:\n - Safely skip clist deletion when list is empty and fp->conn is NULL.\n - Remove the lock from the old connection's lock_list in\n   session_fd_check()\n - Re-add the lock to the new connection's lock_list in\n   ksmbd_reopen_durable_fd()."}],"id":"CVE-2026-31718","lastModified":"2026-06-17T10:34:18.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.963","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0000a7780e0e446a28a273572f6ea8f7f582f694"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/235e32320a470fcd3998fb3774f2290a0eb302a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d6682726c2d3a46d31dae88b8166786b09b03ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b34fc42cfe922e551f7a27d3ac3bb016e41d7dd9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e33c65f011980b4ad4abfd93585ec2079856368f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0000a7780e0e446a28a273572f6ea8f7f582f694","status":"affected","version":"8df4bcdb0a4232192b2445256c39b787d58ef14d","versionType":"git"},{"lessThan":"e33c65f011980b4ad4abfd93585ec2079856368f","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"3d6682726c2d3a46d31dae88b8166786b09b03ad","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"b34fc42cfe922e551f7a27d3ac3bb016e41d7dd9","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"235e32320a470fcd3998fb3774f2290a0eb302a1","status":"affected","version":"c8efcc786146a951091588e5fa7e3c754850cb3c","versionType":"git"},{"lessThan":"6.6.140","status":"affected","version":"6.6.32","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/vfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2C15E547-F33F-4337-A576-685C65C6D439","versionEndExcluding":"6.7","versionStartIncluding":"6.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E8C01EA7-003E-4236-9C2D-0C2322FB0CE3","versionEndExcluding":"6.12.84","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C","versionEndExcluding":"6.18.25","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in __ksmbd_close_fd() via durable scavenger\n\nWhen a durable file handle survives session disconnect (TCP close without\nSMB2_LOGOFF), session_fd_check() sets fp->conn = NULL to preserve the\nhandle for later reconnection. However, it did not clean up the byte-range\nlocks on fp->lock_list.\n\nLater, when the durable scavenger thread times out and calls\n__ksmbd_close_fd(NULL, fp), the lock cleanup loop did:\n\n    spin_lock(&fp->conn->llist_lock);\n\nThis caused a slab use-after-free because fp->conn was NULL and the\noriginal connection object had already been freed by\nksmbd_tcp_disconnect().\n\nThe root cause is asymmetric cleanup: lock entries (smb_lock->clist) were\nleft dangling on the freed conn->lock_list while fp->conn was nulled out.\n\nTo fix this issue properly, we need to handle the lifetime of\nsmb_lock->clist across three paths:\n - Safely skip clist deletion when list is empty and fp->conn is NULL.\n - Remove the lock from the old connection's lock_list in\n   session_fd_check()\n - Re-add the lock to the new connection's lock_list in\n   ksmbd_reopen_durable_fd()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corrección de uso después de liberación en __ksmbd_close_fd() a través del recolector duradero\n\nCuando un manejador de archivo duradero sobrevive a la desconexión de la sesión (cierre TCP sin SMB2_LOGOFF), session_fd_check() establece fp  ->  conn = NULL para preservar el manejador para una reconexión posterior. Sin embargo, no limpió los bloqueos de rango de bytes en fp  ->  lock_list.\n\nMás tarde, cuando el hilo recolector duradero agota el tiempo de espera y llama a __ksmbd_close_fd(NULL, fp), el bucle de limpieza de bloqueos hizo:\n\n    spin_lock(&fp  ->  conn  ->  llist_lock);\n\nEsto causó un uso después de liberación de slab porque fp  ->  conn era NULL y el objeto de conexión original ya había sido liberado por ksmbd_tcp_disconnect().\n\nLa causa raíz es una limpieza asimétrica: las entradas de bloqueo (smb_lock  ->  clist) quedaron colgando en la conn  ->  lock_list liberada mientras fp  ->  conn se anulaba.\n\nPara corregir este problema correctamente, necesitamos manejar la vida útil de smb_lock  ->  clist a través de tres rutas:\n - Omitir de forma segura la eliminación de clist cuando la lista está vacía y fp  ->  conn es NULL.\n - Eliminar el bloqueo de la lock_list de la conexión antigua en session_fd_check()\n - Volver a añadir el bloqueo a la lock_list de la nueva conexión en ksmbd_reopen_durable_fd()."}],"id":"CVE-2026-31718","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T14:16:21.963","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0000a7780e0e446a28a273572f6ea8f7f582f694"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/235e32320a470fcd3998fb3774f2290a0eb302a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d6682726c2d3a46d31dae88b8166786b09b03ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b34fc42cfe922e551f7a27d3ac3bb016e41d7dd9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e33c65f011980b4ad4abfd93585ec2079856368f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31719.json b/data/2026/CVE-2026-31719.json
index 4e279086cb..337b5e60d5 100644
--- a/data/2026/CVE-2026-31719.json
+++ b/data/2026/CVE-2026-31719.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/krb5enc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"07cbb1bd424370671814a862913c99a6e1441588","status":"affected","version":"d1775a177f7f38156d541c8a3e3c91eaa6e69699","versionType":"git"},{"lessThan":"e51f42114abbdf47f29dda43e7826be28907fcd2","status":"affected","version":"d1775a177f7f38156d541c8a3e3c91eaa6e69699","versionType":"git"},{"lessThan":"3bfbf5f0a99c991769ec562721285df7ab69240b","status":"affected","version":"d1775a177f7f38156d541c8a3e3c91eaa6e69699","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/krb5enc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F2D3B79E-3EFA-4203-9F11-FF77FD2FBA79","versionEndExcluding":"6.18.25","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5enc - fix async decrypt skipping hash verification\n\nkrb5enc_dispatch_decrypt() sets req->base.complete as the skcipher\ncallback, which is the caller's own completion handler. When the\nskcipher completes asynchronously, this signals \"done\" to the caller\nwithout executing krb5enc_dispatch_decrypt_hash(), completely bypassing\nthe integrity verification (hash check).\n\nCompare with the encrypt path which correctly uses\nkrb5enc_encrypt_done as an intermediate callback to chain into the\nhash computation on async completion.\n\nFix by adding krb5enc_decrypt_done as an intermediate callback that\nchains into krb5enc_dispatch_decrypt_hash() upon async skcipher\ncompletion, matching the encrypt path's callback pattern.\n\nAlso fix EBUSY/EINPROGRESS handling throughout: remove\nkrb5enc_request_complete() which incorrectly swallowed EINPROGRESS\nnotifications that must be passed up to callers waiting on backlogged\nrequests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done\nfor the dispatch_encrypt return value.\n\n\nUnset MAY_BACKLOG on the async completion path so the user won't\nsee back-to-back EINPROGRESS notifications."}],"id":"CVE-2026-31719","lastModified":"2026-10-19T20:17:57.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31719","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:50.260721Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:22.077","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07cbb1bd424370671814a862913c99a6e1441588"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3bfbf5f0a99c991769ec562721285df7ab69240b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e51f42114abbdf47f29dda43e7826be28907fcd2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-354"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/krb5enc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"07cbb1bd424370671814a862913c99a6e1441588","status":"affected","version":"d1775a177f7f38156d541c8a3e3c91eaa6e69699","versionType":"git"},{"lessThan":"e51f42114abbdf47f29dda43e7826be28907fcd2","status":"affected","version":"d1775a177f7f38156d541c8a3e3c91eaa6e69699","versionType":"git"},{"lessThan":"3bfbf5f0a99c991769ec562721285df7ab69240b","status":"affected","version":"d1775a177f7f38156d541c8a3e3c91eaa6e69699","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/krb5enc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.25","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F2D3B79E-3EFA-4203-9F11-FF77FD2FBA79","versionEndExcluding":"6.18.25","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8","versionEndExcluding":"7.0.2","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: krb5enc - fix async decrypt skipping hash verification\n\nkrb5enc_dispatch_decrypt() sets req->base.complete as the skcipher\ncallback, which is the caller's own completion handler. When the\nskcipher completes asynchronously, this signals \"done\" to the caller\nwithout executing krb5enc_dispatch_decrypt_hash(), completely bypassing\nthe integrity verification (hash check).\n\nCompare with the encrypt path which correctly uses\nkrb5enc_encrypt_done as an intermediate callback to chain into the\nhash computation on async completion.\n\nFix by adding krb5enc_decrypt_done as an intermediate callback that\nchains into krb5enc_dispatch_decrypt_hash() upon async skcipher\ncompletion, matching the encrypt path's callback pattern.\n\nAlso fix EBUSY/EINPROGRESS handling throughout: remove\nkrb5enc_request_complete() which incorrectly swallowed EINPROGRESS\nnotifications that must be passed up to callers waiting on backlogged\nrequests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done\nfor the dispatch_encrypt return value.\n\n\nUnset MAY_BACKLOG on the async completion path so the user won't\nsee back-to-back EINPROGRESS notifications."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncripto: krb5enc - corrige el descifrado asíncrono que omite la verificación de hash\n\nkrb5enc_dispatch_decrypt() establece req  ->  base.complete como la devolución de llamada de skcipher, que es el propio gestor de finalización del llamador. Cuando el skcipher finaliza asíncronamente, esto señala ’hecho’ al llamador sin ejecutar krb5enc_dispatch_decrypt_hash(), omitiendo completamente la verificación de integridad (comprobación de hash).\n\nComparar con la ruta de cifrado que utiliza correctamente krb5enc_encrypt_done como una devolución de llamada intermedia para encadenar en el cálculo de hash en la finalización asíncrona.\n\nSolución añadiendo krb5enc_decrypt_done como una devolución de llamada intermedia que encadena en krb5enc_dispatch_decrypt_hash() tras la finalización asíncrona de skcipher, coincidiendo con el patrón de devolución de llamada de la ruta de cifrado.\n\nTambién corrige el manejo de EBUSY/EINPROGRESS en todo el código: elimina krb5enc_request_complete() que incorrectamente ’tragaba’ las notificaciones de EINPROGRESS que deben pasarse a los llamadores que esperan solicitudes en cola, y añade comprobaciones de EBUSY faltantes en krb5enc_encrypt_ahash_done para el valor de retorno de dispatch_encrypt.\n\nDesestablece MAY_BACKLOG en la ruta de finalización asíncrona para que el usuario no vea notificaciones de EINPROGRESS consecutivas."}],"id":"CVE-2026-31719","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31719","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:50.260721Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:22.077","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07cbb1bd424370671814a862913c99a6e1441588"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3bfbf5f0a99c991769ec562721285df7ab69240b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e51f42114abbdf47f29dda43e7826be28907fcd2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-354"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31720.json b/data/2026/CVE-2026-31720.json
index f1f373b7b8..d1508d37dd 100644
--- a/data/2026/CVE-2026-31720.json
+++ b/data/2026/CVE-2026-31720.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_uac1_legacy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"557d1d4e862eccd0b74cc377b66de3e1e8d49605","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"21b11e8581285c6f10ef43d05df349d445f24273","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"0d41772d98dcaf6c17e875b7d0ea0154ae1191ee","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"c6da4fed7537aec19880c24f6c3a95065adb1406","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"8e5eb1d6e6a3d7bbea9c92132d0cda5793176426","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"26304d124e7f0383f8fe1168b5801a0ac7e16b1c","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"6e0e34d85cd46ceb37d16054e97a373a32770f6c","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_uac1_legacy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B50E0851-B870-41D9-8E6F-BA8182EF6CCB","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate control request size\n\nf_audio_complete() copies req->length bytes into a 4-byte stack\nvariable:\n\n  u32 data = 0;\n  memcpy(&data, req->buf, req->length);\n\nreq->length is derived from the host-controlled USB request path,\nwhich can lead to a stack out-of-bounds write.\n\nValidate req->actual against the expected payload size for the\nsupported control selectors and decode only the expected amount\nof data.\n\nThis avoids copying a host-influenced length into a fixed-size\nstack object."}],"id":"CVE-2026-31720","lastModified":"2026-06-17T10:34:18.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.360","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_uac1_legacy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"557d1d4e862eccd0b74cc377b66de3e1e8d49605","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"21b11e8581285c6f10ef43d05df349d445f24273","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"0d41772d98dcaf6c17e875b7d0ea0154ae1191ee","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"c6da4fed7537aec19880c24f6c3a95065adb1406","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"8e5eb1d6e6a3d7bbea9c92132d0cda5793176426","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"26304d124e7f0383f8fe1168b5801a0ac7e16b1c","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"},{"lessThan":"6e0e34d85cd46ceb37d16054e97a373a32770f6c","status":"affected","version":"c6994e6f067cf0fc4c6cca3d164018b1150916f8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_uac1_legacy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B50E0851-B870-41D9-8E6F-BA8182EF6CCB","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate control request size\n\nf_audio_complete() copies req->length bytes into a 4-byte stack\nvariable:\n\n  u32 data = 0;\n  memcpy(&data, req->buf, req->length);\n\nreq->length is derived from the host-controlled USB request path,\nwhich can lead to a stack out-of-bounds write.\n\nValidate req->actual against the expected payload size for the\nsupported control selectors and decode only the expected amount\nof data.\n\nThis avoids copying a host-influenced length into a fixed-size\nstack object."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_uac1_legacy: validar el tamaño de la solicitud de control\n\nf_audio_complete() copia bytes de req  ->  length en una variable de pila de 4 bytes:\n\nu32 data = 0;\nmemcpy(&data, req  ->  buf, req  ->  length);\n\nreq  ->  length se deriva de la ruta de solicitud USB controlada por el host, lo que puede llevar a una escritura fuera de límites de la pila.\n\nValidar req  ->  actual contra el tamaño de carga útil esperado para los selectores de control compatibles y decodificar solo la cantidad de datos esperada.\n\nEsto evita copiar una longitud influenciada por el host en un objeto de pila de tamaño fijo."}],"id":"CVE-2026-31720","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.360","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31721.json b/data/2026/CVE-2026-31721.json
index 4e2c3f5fcb..b78be64d1e 100644
--- a/data/2026/CVE-2026-31721.json
+++ b/data/2026/CVE-2026-31721.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_hid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"13440c0db227c5db01da751ed966dde4cdd2ea18","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"de93e0862169b5539e00c2b9980b93fd80c37c0d","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"81aee4500055876883658b024b6fb61801afe134","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"8ec6a58586f195a88479edcdb0b8027c39f12d03","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"f7d00ee1c8082c8a134340aaf16d71a27e29c362","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"5d1bb391ceeebb28327703dd07af8c6324af298f","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"26a879a41ed960b3fb4ec773ef2788c515c0e488","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"4e0a88254ad59f6c53a34bf5fa241884ec09e8b2","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_hid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"86625D80-8DDF-4C85-86FD-F543ECDDFBA4","versionEndExcluding":"5.10.253","versionStartIncluding":"3.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_hid: move list and spinlock inits from bind to alloc\n\nThere was an issue when you did the following:\n- setup and bind an hid gadget\n- open /dev/hidg0\n- use the resulting fd in EPOLL_CTL_ADD\n- unbind the UDC\n- bind the UDC\n- use the fd in EPOLL_CTL_DEL\n\nWhen CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported\nwithin remove_wait_queue (via ep_remove_wait_queue). After some\ndebugging I found out that the queues, which f_hid registers via\npoll_wait were the problem. These were initialized using\ninit_waitqueue_head inside hidg_bind. So effectively, the bind function\nre-initialized the queues while there were still items in them.\n\nThe solution is to move the initialization from hidg_bind to hidg_alloc\nto extend their lifetimes to the lifetime of the function instance.\n\nAdditionally, I found many other possibly problematic init calls in the\nbind function, which I moved as well."}],"id":"CVE-2026-31721","lastModified":"2026-06-17T10:34:18.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.490","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/13440c0db227c5db01da751ed966dde4cdd2ea18"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26a879a41ed960b3fb4ec773ef2788c515c0e488"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e0a88254ad59f6c53a34bf5fa241884ec09e8b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d1bb391ceeebb28327703dd07af8c6324af298f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/81aee4500055876883658b024b6fb61801afe134"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ec6a58586f195a88479edcdb0b8027c39f12d03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de93e0862169b5539e00c2b9980b93fd80c37c0d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7d00ee1c8082c8a134340aaf16d71a27e29c362"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_hid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"13440c0db227c5db01da751ed966dde4cdd2ea18","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"de93e0862169b5539e00c2b9980b93fd80c37c0d","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"81aee4500055876883658b024b6fb61801afe134","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"8ec6a58586f195a88479edcdb0b8027c39f12d03","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"f7d00ee1c8082c8a134340aaf16d71a27e29c362","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"5d1bb391ceeebb28327703dd07af8c6324af298f","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"26a879a41ed960b3fb4ec773ef2788c515c0e488","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"4e0a88254ad59f6c53a34bf5fa241884ec09e8b2","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_hid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"86625D80-8DDF-4C85-86FD-F543ECDDFBA4","versionEndExcluding":"5.10.253","versionStartIncluding":"3.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_hid: move list and spinlock inits from bind to alloc\n\nThere was an issue when you did the following:\n- setup and bind an hid gadget\n- open /dev/hidg0\n- use the resulting fd in EPOLL_CTL_ADD\n- unbind the UDC\n- bind the UDC\n- use the fd in EPOLL_CTL_DEL\n\nWhen CONFIG_DEBUG_LIST was enabled, a list_del corruption was reported\nwithin remove_wait_queue (via ep_remove_wait_queue). After some\ndebugging I found out that the queues, which f_hid registers via\npoll_wait were the problem. These were initialized using\ninit_waitqueue_head inside hidg_bind. So effectively, the bind function\nre-initialized the queues while there were still items in them.\n\nThe solution is to move the initialization from hidg_bind to hidg_alloc\nto extend their lifetimes to the lifetime of the function instance.\n\nAdditionally, I found many other possibly problematic init calls in the\nbind function, which I moved as well."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_hid: mover inicializaciones de lista y spinlock de bind a alloc\n\nHubo un problema cuando se hizo lo siguiente:\n- configurar y enlazar un gadget hid\n- abrir /dev/hidg0\n- usar el fd resultante en EPOLL_CTL_ADD\n- desenlazar el UDC\n- enlazar el UDC\n- usar el fd en EPOLL_CTL_DEL\n\nCuando CONFIG_DEBUG_LIST estaba habilitado, se informó una corrupción de list_del dentro de remove_wait_queue (a través de ep_remove_wait_queue). Después de alguna depuración, descubrí que las colas, que f_hid registra a través de poll_wait, eran el problema. Estas se inicializaban usando init_waitqueue_head dentro de hidg_bind. Así que, efectivamente, la función bind reinicializaba las colas mientras todavía había elementos en ellas.\n\nLa solución es mover la inicialización de hidg_bind a hidg_alloc para extender sus vidas útiles a la vida útil de la instancia de la función.\n\nAdemás, encontré muchas otras llamadas de inicialización posiblemente problemáticas en la función bind, las cuales también moví."}],"id":"CVE-2026-31721","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.490","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/13440c0db227c5db01da751ed966dde4cdd2ea18"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26a879a41ed960b3fb4ec773ef2788c515c0e488"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e0a88254ad59f6c53a34bf5fa241884ec09e8b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d1bb391ceeebb28327703dd07af8c6324af298f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/81aee4500055876883658b024b6fb61801afe134"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ec6a58586f195a88479edcdb0b8027c39f12d03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de93e0862169b5539e00c2b9980b93fd80c37c0d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7d00ee1c8082c8a134340aaf16d71a27e29c362"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31722.json b/data/2026/CVE-2026-31722.json
index 9eb3f73889..097c3831ee 100644
--- a/data/2026/CVE-2026-31722.json
+++ b/data/2026/CVE-2026-31722.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_rndis.c","drivers/usb/gadget/function/u_rndis.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f374388891778c2f58facc0f61f2610a206a1876","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"9701a98f4459b52558f683b6b12a6feb6f17b255","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"1ef251aa63972fe6c0f107f5abd139b7d0f7987a","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"18ada801899f2b13ef0ceff42427ad980a41e619","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"6045ea5ca6e3fa13f8a9fafb1c535c86e124c14d","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"e367599529dc42578545a7f85fde517b35b3cda7","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_rndis.c","drivers/usb/gadget/function/u_rndis.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DDEB484-A8B8-4ED2-B54C-C92F595BA13F","versionEndExcluding":"6.12.81","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_rndis: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0 ->\n  /sys/devices/platform/.../gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n  ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe borrowed_net flag is used to indicate whether the network device is\nshared and pre-registered during the legacy driver's bind phase."}],"id":"CVE-2026-31722","lastModified":"2026-10-30T13:18:43.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.617","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18ada801899f2b13ef0ceff42427ad980a41e619"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1ef251aa63972fe6c0f107f5abd139b7d0f7987a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6045ea5ca6e3fa13f8a9fafb1c535c86e124c14d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9701a98f4459b52558f683b6b12a6feb6f17b255"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e367599529dc42578545a7f85fde517b35b3cda7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f374388891778c2f58facc0f61f2610a206a1876"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_rndis.c","drivers/usb/gadget/function/u_rndis.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f374388891778c2f58facc0f61f2610a206a1876","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"9701a98f4459b52558f683b6b12a6feb6f17b255","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"1ef251aa63972fe6c0f107f5abd139b7d0f7987a","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"18ada801899f2b13ef0ceff42427ad980a41e619","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"6045ea5ca6e3fa13f8a9fafb1c535c86e124c14d","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"},{"lessThan":"e367599529dc42578545a7f85fde517b35b3cda7","status":"affected","version":"f466c6353819326873fa48a02c6f2d7c903240d6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_rndis.c","drivers/usb/gadget/function/u_rndis.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DDEB484-A8B8-4ED2-B54C-C92F595BA13F","versionEndExcluding":"6.12.81","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_rndis: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0 ->\n  /sys/devices/platform/.../gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n  ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe borrowed_net flag is used to indicate whether the network device is\nshared and pre-registered during the legacy driver's bind phase."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_rndis: Corrección del ciclo de vida de net_device con device_move\n\nEl net_device se asigna durante la creación de la instancia de función y se registra durante la fase de enlace con el dispositivo gadget como su padre sysfs. Cuando la función se desenlaza, el dispositivo padre es destruido, pero el net_device sobrevive, lo que resulta en enlaces simbólicos sysfs colgantes:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0   ->  \n  /sys/devices/platform/... / gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/... / gadget.0/net/usb0\n  ls: ... / gadget.0/net/usb0: No such file or directory\n\nUsar device_move() para reparentar el net_device entre el árbol de dispositivos gadget y /sys/devices/virtual a través de los ciclos de enlace y desenlace. Durante el desenlace final, llamar a device_move(NULL) mueve el net_device al árbol de dispositivos virtuales antes de que el dispositivo gadget sea destruido. Al reenlazar, device_move() reparenta el dispositivo de nuevo bajo el nuevo gadget, asegurando una topología sysfs adecuada y un ordenamiento de la gestión de energía.\n\nPara mantener la compatibilidad con los controladores compuestos heredados (p. ej., multi.c), se utiliza la bandera borrowed_net para indicar si el dispositivo de red es compartido y pre-registrado durante la fase de enlace del controlador heredado."}],"id":"CVE-2026-31722","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.617","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18ada801899f2b13ef0ceff42427ad980a41e619"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1ef251aa63972fe6c0f107f5abd139b7d0f7987a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6045ea5ca6e3fa13f8a9fafb1c535c86e124c14d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9701a98f4459b52558f683b6b12a6feb6f17b255"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e367599529dc42578545a7f85fde517b35b3cda7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f374388891778c2f58facc0f61f2610a206a1876"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31723.json b/data/2026/CVE-2026-31723.json
index 4c5cf7219f..46b6818e8a 100644
--- a/data/2026/CVE-2026-31723.json
+++ b/data/2026/CVE-2026-31723.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_subset.c","drivers/usb/gadget/function/u_gether.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c26916e8413c8fc44834fd9df4899312fd6cf880","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"edb08047051883591517feb5a51bf2bfd2b769fb","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"70707ce668494c4d35fe070dfbc7cc541b293107","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"9cbc4f109bb216623894d8819fb930210ed34b21","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"fde29916e4cc736c4ca6c78f331e12b2c73ccafd","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"06524cd1c9011bee141a87e43ab878641ed3652b","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_subset.c","drivers/usb/gadget/function/u_gether.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DDEB484-A8B8-4ED2-B54C-C92F595BA13F","versionEndExcluding":"6.12.81","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_subset: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0 ->\n  /sys/devices/platform/.../gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n  ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."}],"id":"CVE-2026-31723","lastModified":"2026-10-30T13:18:43.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.727","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/06524cd1c9011bee141a87e43ab878641ed3652b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70707ce668494c4d35fe070dfbc7cc541b293107"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9cbc4f109bb216623894d8819fb930210ed34b21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c26916e8413c8fc44834fd9df4899312fd6cf880"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/edb08047051883591517feb5a51bf2bfd2b769fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fde29916e4cc736c4ca6c78f331e12b2c73ccafd"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_subset.c","drivers/usb/gadget/function/u_gether.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c26916e8413c8fc44834fd9df4899312fd6cf880","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"edb08047051883591517feb5a51bf2bfd2b769fb","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"70707ce668494c4d35fe070dfbc7cc541b293107","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"9cbc4f109bb216623894d8819fb930210ed34b21","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"fde29916e4cc736c4ca6c78f331e12b2c73ccafd","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"},{"lessThan":"06524cd1c9011bee141a87e43ab878641ed3652b","status":"affected","version":"8cedba7c73af1369599b1111639cfeb66fe13aaa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_subset.c","drivers/usb/gadget/function/u_gether.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DDEB484-A8B8-4ED2-B54C-C92F595BA13F","versionEndExcluding":"6.12.81","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_subset: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0 ->\n  /sys/devices/platform/.../gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n  ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_subset: Solucionar el ciclo de vida de net_device con device_move\n\nEl net_device se asigna durante la creación de la instancia de función y se registra durante la fase de enlace con el dispositivo gadget como su padre sysfs. Cuando la función se desenlaza, el dispositivo padre es destruido, pero el net_device sobrevive, lo que resulta en enlaces simbólicos sysfs colgantes:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0   ->  \n  /sys/devices/platform/... / gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/... / gadget.0/net/usb0\n  ls: ... / gadget.0/net/usb0: No existe el archivo o directorio\n\nUsar device_move() para reparentar el net_device entre el árbol de dispositivos gadget y /sys/devices/virtual a través de los ciclos de enlace y desenlace. Durante el desenlace final, llamar a device_move(NULL) mueve el net_device al árbol de dispositivos virtuales antes de que el dispositivo gadget sea destruido. Al reenlazar, device_move() reparenta el dispositivo de nuevo bajo el nuevo gadget, asegurando una topología sysfs adecuada y un ordenamiento de la gestión de energía.\n\nPara mantener la compatibilidad con controladores compuestos heredados (p. ej., multi.c), se utiliza la bandera ’bound’ para indicar si el dispositivo de red es compartido y pre-registrado durante la fase de enlace del controlador heredado."}],"id":"CVE-2026-31723","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.727","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/06524cd1c9011bee141a87e43ab878641ed3652b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70707ce668494c4d35fe070dfbc7cc541b293107"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9cbc4f109bb216623894d8819fb930210ed34b21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c26916e8413c8fc44834fd9df4899312fd6cf880"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/edb08047051883591517feb5a51bf2bfd2b769fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fde29916e4cc736c4ca6c78f331e12b2c73ccafd"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31724.json b/data/2026/CVE-2026-31724.json
index f48da5cb6e..891b2d12f3 100644
--- a/data/2026/CVE-2026-31724.json
+++ b/data/2026/CVE-2026-31724.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_eem.c","drivers/usb/gadget/function/u_eem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2479c26019a4009d84c7b98031a9fd7f9871a16b","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"b1d854462510f7b7c504bfd5f8ec19c0737ed5e4","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"a6b8bce01a30a8c05c034bbc36c34845d65d644f","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"4ccdccff8febc5456aff684627f9a4c5c83b9346","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"14730506b9e2a09d10c963a57a72ed528482fc15","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"d9270c9a8118c1535409db926ac1e2545dc97b81","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_eem.c","drivers/usb/gadget/function/u_eem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"29787167-D14F-4508-BFBF-9E6689E0AD56","versionEndExcluding":"6.12.81","versionStartIncluding":"3.11.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_eem: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\nconsole:/ # ls -l /sys/class/net/usb0\nlrwxrwxrwx ... /sys/class/net/usb0 ->\n/sys/devices/platform/.../gadget.0/net/usb0\nconsole:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\nls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."}],"id":"CVE-2026-31724","lastModified":"2026-10-30T13:18:43.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.833","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14730506b9e2a09d10c963a57a72ed528482fc15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2479c26019a4009d84c7b98031a9fd7f9871a16b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ccdccff8febc5456aff684627f9a4c5c83b9346"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6b8bce01a30a8c05c034bbc36c34845d65d644f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b1d854462510f7b7c504bfd5f8ec19c0737ed5e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d9270c9a8118c1535409db926ac1e2545dc97b81"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_eem.c","drivers/usb/gadget/function/u_eem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2479c26019a4009d84c7b98031a9fd7f9871a16b","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"b1d854462510f7b7c504bfd5f8ec19c0737ed5e4","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"a6b8bce01a30a8c05c034bbc36c34845d65d644f","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"4ccdccff8febc5456aff684627f9a4c5c83b9346","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"14730506b9e2a09d10c963a57a72ed528482fc15","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"},{"lessThan":"d9270c9a8118c1535409db926ac1e2545dc97b81","status":"affected","version":"b29002a157940752dfed2c488b2011f63f007d71","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_eem.c","drivers/usb/gadget/function/u_eem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"29787167-D14F-4508-BFBF-9E6689E0AD56","versionEndExcluding":"6.12.81","versionStartIncluding":"3.11.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_eem: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\nconsole:/ # ls -l /sys/class/net/usb0\nlrwxrwxrwx ... /sys/class/net/usb0 ->\n/sys/devices/platform/.../gadget.0/net/usb0\nconsole:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\nls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_eem: Solución del ciclo de vida de net_device con device_move\n\nEl net_device se asigna durante la creación de la instancia de función y se registra durante la fase de enlace con el dispositivo gadget como su padre sysfs. Cuando la función se desenlaza, el dispositivo padre es destruido, pero el net_device sobrevive, lo que resulta en enlaces simbólicos sysfs colgantes:\n\nconsole:/ # ls -l /sys/class/net/usb0\nlrwxrwxrwx ... /sys/class/net/usb0   ->  \n/sys/devices/platform/... / gadget.0/net/usb0\nconsole:/ # ls -l /sys/devices/platform/... / gadget.0/net/usb0\nls: ... / gadget.0/net/usb0: No existe el archivo o directorio\n\nUsar device_move() para reparentar el net_device entre el árbol de dispositivos gadget y /sys/devices/virtual a través de los ciclos de enlace y desenlace. Durante el desenlace final, llamar a device_move(NULL) mueve el net_device al árbol de dispositivos virtuales antes de que el dispositivo gadget sea destruido. Al volver a enlazar, device_move() reparenta el dispositivo de nuevo bajo el nuevo gadget, asegurando una topología sysfs adecuada y un ordenamiento de la gestión de energía.\n\nPara mantener la compatibilidad con controladores compuestos heredados (p. ej., multi.c), se utiliza el indicador ’bound’ para indicar si el dispositivo de red se comparte y se pre-registra durante la fase de enlace del controlador heredado."}],"id":"CVE-2026-31724","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.833","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14730506b9e2a09d10c963a57a72ed528482fc15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2479c26019a4009d84c7b98031a9fd7f9871a16b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ccdccff8febc5456aff684627f9a4c5c83b9346"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6b8bce01a30a8c05c034bbc36c34845d65d644f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b1d854462510f7b7c504bfd5f8ec19c0737ed5e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d9270c9a8118c1535409db926ac1e2545dc97b81"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31725.json b/data/2026/CVE-2026-31725.json
index 3192b7fa27..88de465b68 100644
--- a/data/2026/CVE-2026-31725.json
+++ b/data/2026/CVE-2026-31725.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_ecm.c","drivers/usb/gadget/function/u_ecm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"40c4d35c71a170889fe9333a1feb69a4dd5d4365","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"fdc3aa4c23d3e0ed781ca0e10213c645e445cc03","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"5eaeac22240d965d24c3bd0c54ded64efd8f6ca1","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"4e34f3f491fd731809b57ddb5329ec763bd39553","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"9b1e5589593293c78a2ab8bb118a41e2271a2af8","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"b2cc4fae67a51f60d81d6af2678696accb07c656","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_ecm.c","drivers/usb/gadget/function/u_ecm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DDEB484-A8B8-4ED2-B54C-C92F595BA13F","versionEndExcluding":"6.12.81","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ecm: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0 ->\n  /sys/devices/platform/.../gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n  ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."}],"id":"CVE-2026-31725","lastModified":"2026-10-30T13:18:43.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.947","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/40c4d35c71a170889fe9333a1feb69a4dd5d4365"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e34f3f491fd731809b57ddb5329ec763bd39553"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5eaeac22240d965d24c3bd0c54ded64efd8f6ca1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b1e5589593293c78a2ab8bb118a41e2271a2af8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b2cc4fae67a51f60d81d6af2678696accb07c656"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fdc3aa4c23d3e0ed781ca0e10213c645e445cc03"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_ecm.c","drivers/usb/gadget/function/u_ecm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"40c4d35c71a170889fe9333a1feb69a4dd5d4365","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"fdc3aa4c23d3e0ed781ca0e10213c645e445cc03","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"5eaeac22240d965d24c3bd0c54ded64efd8f6ca1","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"4e34f3f491fd731809b57ddb5329ec763bd39553","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"9b1e5589593293c78a2ab8bb118a41e2271a2af8","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"},{"lessThan":"b2cc4fae67a51f60d81d6af2678696accb07c656","status":"affected","version":"fee562a6450b7806f1fbbe1469a67b5395b5c10a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_ecm.c","drivers/usb/gadget/function/u_ecm.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DDEB484-A8B8-4ED2-B54C-C92F595BA13F","versionEndExcluding":"6.12.81","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ecm: Fix net_device lifecycle with device_move\n\nThe net_device is allocated during function instance creation and\nregistered during the bind phase with the gadget device as its sysfs\nparent. When the function unbinds, the parent device is destroyed, but\nthe net_device survives, resulting in dangling sysfs symlinks:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0 ->\n  /sys/devices/platform/.../gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/.../gadget.0/net/usb0\n  ls: .../gadget.0/net/usb0: No such file or directory\n\nUse device_move() to reparent the net_device between the gadget device\ntree and /sys/devices/virtual across bind and unbind cycles. During the\nfinal unbind, calling device_move(NULL) moves the net_device to the\nvirtual device tree before the gadget device is destroyed. On rebinding,\ndevice_move() reparents the device back under the new gadget, ensuring\nproper sysfs topology and power management ordering.\n\nTo maintain compatibility with legacy composite drivers (e.g., multi.c),\nthe bound flag is used to indicate whether the network device is shared\nand pre-registered during the legacy driver's bind phase."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_ecm: Corrección del ciclo de vida de net_device con device_move\n\nEl net_device se asigna durante la creación de la instancia de función y se registra durante la fase de enlace con el dispositivo gadget como su padre sysfs. Cuando la función se desvincula, el dispositivo padre es destruido, pero el net_device sobrevive, lo que resulta en enlaces simbólicos sysfs colgantes:\n\n  console:/ # ls -l /sys/class/net/usb0\n  lrwxrwxrwx ... /sys/class/net/usb0   ->  \n  /sys/devices/platform/... / gadget.0/net/usb0\n  console:/ # ls -l /sys/devices/platform/... / gadget.0/net/usb0\n  ls: ... / gadget.0/net/usb0: No existe tal archivo o directorio\n\nUsar device_move() para reasignar el padre al net_device entre el árbol de dispositivos gadget y /sys/devices/virtual a través de los ciclos de enlace y desvinculación. Durante la desvinculación final, al llamar a device_move(NULL) se mueve el net_device al árbol de dispositivos virtual antes de que el dispositivo gadget sea destruido. Al volver a enlazar, device_move() reasigna el padre al dispositivo de nuevo bajo el nuevo gadget, asegurando una topología sysfs y un orden de gestión de energía adecuados.\n\nPara mantener la compatibilidad con controladores compuestos heredados (p. ej., multi.c), se utiliza la bandera ’bound’ para indicar si el dispositivo de red se comparte y se pre-registra durante la fase de enlace del controlador heredado."}],"id":"CVE-2026-31725","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:34.947","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/40c4d35c71a170889fe9333a1feb69a4dd5d4365"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e34f3f491fd731809b57ddb5329ec763bd39553"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5eaeac22240d965d24c3bd0c54ded64efd8f6ca1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b1e5589593293c78a2ab8bb118a41e2271a2af8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b2cc4fae67a51f60d81d6af2678696accb07c656"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fdc3aa4c23d3e0ed781ca0e10213c645e445cc03"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31726.json b/data/2026/CVE-2026-31726.json
index 372f8cfa5c..f25de8f240 100644
--- a/data/2026/CVE-2026-31726.json
+++ b/data/2026/CVE-2026-31726.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_uvc.c","drivers/usb/gadget/function/uvc.h","drivers/usb/gadget/function/uvc_v4l2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0c00ec409d7b2bce3fcac73188b79a141db7cfda","status":"affected","version":"1444e0568bc2c70868e7b8da5b46fc2252acc3f5","versionType":"git"},{"lessThan":"d92d1532e05b1b31d36d48765e43bf73d793d19f","status":"affected","version":"4962e5a2f301d24953f17d6748d986e21566abe1","versionType":"git"},{"lessThan":"0587de744615628c38e33ddc1601160a5ea8c50a","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"c78e463ee134b4669579d453c81ae00795e4c19a","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"8a1128d604c360eca135f15b882b70256a522145","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"1aa9356881ee4ed414bf72d0c56d915492cb5345","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"c038ba56b92e410d1caec22b2dc68780a0b42091","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"eba2936bbe6b752a31725a9eb5c674ecbf21ee7d","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"status":"affected","version":"e10735ce87502b07e171727e574afdd6c0890a08","versionType":"git"},{"lessThan":"5.10.253","status":"affected","version":"5.10.117","versionType":"semver"},{"lessThan":"5.15.203","status":"affected","version":"5.15.41","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.9","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_uvc.c","drivers/usb/gadget/function/uvc.h","drivers/usb/gadget/function/uvc_v4l2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3107A7FD-A692-4C8A-AEB6-F0D2F2662FB9","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10.117","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"10AB2B1C-2087-4373-A0B0-DF5A1661F0BA","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.41","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BA6F49FC-BA51-4640-976D-34617774A48C","versionEndExcluding":"6.1.168","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix NULL pointer dereference during unbind race\n\nCommit b81ac4395bbe (\"usb: gadget: uvc: allow for application to cleanly\nshutdown\") introduced two stages of synchronization waits totaling 1500ms\nin uvc_function_unbind() to prevent several types of kernel panics.\nHowever, this timing-based approach is insufficient during power\nmanagement (PM) transitions.\n\nWhen the PM subsystem starts freezing user space processes, the\nwait_event_interruptible_timeout() is aborted early, which allows the\nunbind thread to proceed and nullify the gadget pointer\n(cdev->gadget = NULL):\n\n[  814.123447][  T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()\n[  814.178583][ T3173] PM: suspend entry (deep)\n[  814.192487][ T3173] Freezing user space processes\n[  814.197668][  T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release\n\nWhen the PM subsystem resumes or aborts the suspend and tasks are\nrestarted, the V4L2 release path is executed and attempts to access the\nalready nullified gadget pointer, triggering a kernel panic:\n\n[  814.292597][    C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake\n[  814.386727][ T3173] Restarting tasks ...\n[  814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030\n[  814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4\n[  814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94\n[  814.404078][ T4558] Call trace:\n[  814.404080][ T4558]  usb_gadget_deactivate+0x14/0xf4\n[  814.404083][ T4558]  usb_function_deactivate+0x54/0x94\n[  814.404087][ T4558]  uvc_function_disconnect+0x1c/0x5c\n[  814.404092][ T4558]  uvc_v4l2_release+0x44/0xac\n[  814.404095][ T4558]  v4l2_release+0xcc/0x130\n\nAddress the race condition and NULL pointer dereference by:\n\n1. State Synchronization (flag + mutex)\nIntroduce a 'func_unbound' flag in struct uvc_device. This allows\nuvc_function_disconnect() to safely skip accessing the nullified\ncdev->gadget pointer. As suggested by Alan Stern, this flag is protected\nby a new mutex (uvc->lock) to ensure proper memory ordering and prevent\ninstruction reordering or speculative loads. This mutex is also used to\nprotect 'func_connected' for consistent state management.\n\n2. Explicit Synchronization (completion)\nUse a completion to synchronize uvc_function_unbind() with the\nuvc_vdev_release() callback. This prevents Use-After-Free (UAF) by\nensuring struct uvc_device is freed after all video device resources\nare released."}],"id":"CVE-2026-31726","lastModified":"2026-06-17T10:34:19.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.063","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0587de744615628c38e33ddc1601160a5ea8c50a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c00ec409d7b2bce3fcac73188b79a141db7cfda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1aa9356881ee4ed414bf72d0c56d915492cb5345"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a1128d604c360eca135f15b882b70256a522145"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c038ba56b92e410d1caec22b2dc68780a0b42091"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c78e463ee134b4669579d453c81ae00795e4c19a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d92d1532e05b1b31d36d48765e43bf73d793d19f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eba2936bbe6b752a31725a9eb5c674ecbf21ee7d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_uvc.c","drivers/usb/gadget/function/uvc.h","drivers/usb/gadget/function/uvc_v4l2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0c00ec409d7b2bce3fcac73188b79a141db7cfda","status":"affected","version":"1444e0568bc2c70868e7b8da5b46fc2252acc3f5","versionType":"git"},{"lessThan":"d92d1532e05b1b31d36d48765e43bf73d793d19f","status":"affected","version":"4962e5a2f301d24953f17d6748d986e21566abe1","versionType":"git"},{"lessThan":"0587de744615628c38e33ddc1601160a5ea8c50a","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"c78e463ee134b4669579d453c81ae00795e4c19a","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"8a1128d604c360eca135f15b882b70256a522145","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"1aa9356881ee4ed414bf72d0c56d915492cb5345","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"c038ba56b92e410d1caec22b2dc68780a0b42091","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"lessThan":"eba2936bbe6b752a31725a9eb5c674ecbf21ee7d","status":"affected","version":"b81ac4395bbeaf36e078dea1a48c02dd97b76235","versionType":"git"},{"status":"affected","version":"e10735ce87502b07e171727e574afdd6c0890a08","versionType":"git"},{"lessThan":"5.10.253","status":"affected","version":"5.10.117","versionType":"semver"},{"lessThan":"5.15.203","status":"affected","version":"5.15.41","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.9","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_uvc.c","drivers/usb/gadget/function/uvc.h","drivers/usb/gadget/function/uvc_v4l2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3107A7FD-A692-4C8A-AEB6-F0D2F2662FB9","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10.117","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"10AB2B1C-2087-4373-A0B0-DF5A1661F0BA","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.41","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BA6F49FC-BA51-4640-976D-34617774A48C","versionEndExcluding":"6.1.168","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix NULL pointer dereference during unbind race\n\nCommit b81ac4395bbe (\"usb: gadget: uvc: allow for application to cleanly\nshutdown\") introduced two stages of synchronization waits totaling 1500ms\nin uvc_function_unbind() to prevent several types of kernel panics.\nHowever, this timing-based approach is insufficient during power\nmanagement (PM) transitions.\n\nWhen the PM subsystem starts freezing user space processes, the\nwait_event_interruptible_timeout() is aborted early, which allows the\nunbind thread to proceed and nullify the gadget pointer\n(cdev->gadget = NULL):\n\n[  814.123447][  T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()\n[  814.178583][ T3173] PM: suspend entry (deep)\n[  814.192487][ T3173] Freezing user space processes\n[  814.197668][  T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release\n\nWhen the PM subsystem resumes or aborts the suspend and tasks are\nrestarted, the V4L2 release path is executed and attempts to access the\nalready nullified gadget pointer, triggering a kernel panic:\n\n[  814.292597][    C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake\n[  814.386727][ T3173] Restarting tasks ...\n[  814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030\n[  814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4\n[  814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94\n[  814.404078][ T4558] Call trace:\n[  814.404080][ T4558]  usb_gadget_deactivate+0x14/0xf4\n[  814.404083][ T4558]  usb_function_deactivate+0x54/0x94\n[  814.404087][ T4558]  uvc_function_disconnect+0x1c/0x5c\n[  814.404092][ T4558]  uvc_v4l2_release+0x44/0xac\n[  814.404095][ T4558]  v4l2_release+0xcc/0x130\n\nAddress the race condition and NULL pointer dereference by:\n\n1. State Synchronization (flag + mutex)\nIntroduce a 'func_unbound' flag in struct uvc_device. This allows\nuvc_function_disconnect() to safely skip accessing the nullified\ncdev->gadget pointer. As suggested by Alan Stern, this flag is protected\nby a new mutex (uvc->lock) to ensure proper memory ordering and prevent\ninstruction reordering or speculative loads. This mutex is also used to\nprotect 'func_connected' for consistent state management.\n\n2. Explicit Synchronization (completion)\nUse a completion to synchronize uvc_function_unbind() with the\nuvc_vdev_release() callback. This prevents Use-After-Free (UAF) by\nensuring struct uvc_device is freed after all video device resources\nare released."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: uvc: corregir desreferencia de puntero NULL durante una condición de carrera de desvinculación\n\nEl commit b81ac4395bbe (’usb: gadget: uvc: permitir que la aplicación se apague limpiamente’) introdujo dos etapas de esperas de sincronización que suman 1500ms en uvc_function_unbind() para prevenir varios tipos de pánicos del kernel. Sin embargo, este enfoque basado en tiempo es insuficiente durante las transiciones de gestión de energía (PM).\n\nCuando el subsistema PM comienza a congelar los procesos del espacio de usuario, la wait_event_interruptible_timeout() se aborta prematuramente, lo que permite que el hilo de desvinculación continúe y anule el puntero del gadget (cdev  ->  gadget = NULL):\n\n[  814.123447][  T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()\n[  814.178583][ T3173] PM: suspend entry (deep)\n[  814.192487][ T3173] Freezing user space processes\n[  814.197668][  T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release\n\nCuando el subsistema PM reanuda o aborta la suspensión y las tareas se reinician, la ruta de liberación de V4L2 se ejecuta e intenta acceder al puntero del gadget ya anulado, lo que desencadena un pánico del kernel:\n\n[  814.292597][    C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake\n[  814.386727][ T3173] Restarting tasks ...\n[  814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030\n[  814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4\n[  814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94\n[  814.404078][ T4558] Call trace:\n[  814.404080][ T4558]  usb_gadget_deactivate+0x14/0xf4\n[  814.404083][ T4558]  usb_function_deactivate+0x54/0x94\n[  814.404087][ T4558]  uvc_function_disconnect+0x1c/0x5c\n[  814.404092][ T4558]  uvc_v4l2_release+0x44/0xac\n[  814.404095][ T4558]  v4l2_release+0xcc/0x130\n\nAbordar la condición de carrera y la desreferencia de puntero NULL mediante:\n\n1. Sincronización de estado (bandera + mutex)\nIntroducir una bandera ’func_unbound’ en la estructura uvc_device. Esto permite que uvc_function_disconnect() omita de forma segura el acceso al puntero cdev  ->  gadget anulado. Como sugirió Alan Stern, esta bandera está protegida por un nuevo mutex (uvc  ->  lock) para asegurar un ordenamiento de memoria adecuado y prevenir el reordenamiento de instrucciones o cargas especulativas. Este mutex también se utiliza para proteger ’func_connected’ para una gestión de estado consistente.\n\n2. Sincronización explícita (finalización)\nUsar una finalización para sincronizar uvc_function_unbind() con la devolución de llamada uvc_vdev_release(). Esto previene el Uso después de liberación (UAF) asegurando que la estructura uvc_device se libere después de que todos los recursos del dispositivo de video sean liberados."}],"id":"CVE-2026-31726","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.063","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0587de744615628c38e33ddc1601160a5ea8c50a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c00ec409d7b2bce3fcac73188b79a141db7cfda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1aa9356881ee4ed414bf72d0c56d915492cb5345"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a1128d604c360eca135f15b882b70256a522145"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c038ba56b92e410d1caec22b2dc68780a0b42091"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c78e463ee134b4669579d453c81ae00795e4c19a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d92d1532e05b1b31d36d48765e43bf73d793d19f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eba2936bbe6b752a31725a9eb5c674ecbf21ee7d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31727.json b/data/2026/CVE-2026-31727.json
index 59e0a2c5e1..87d25a3a25 100644
--- a/data/2026/CVE-2026-31727.json
+++ b/data/2026/CVE-2026-31727.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f9f987472f4b8ab177be2b6492a59278ed969479","status":"affected","version":"7c97366f5dac5255e60a317ffe3a5b18f3745547","versionType":"git"},{"lessThan":"7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2","status":"affected","version":"36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4","versionType":"git"},{"lessThan":"0326429e8ba99892e1d1e115dc8e88e1a3b64e24","status":"affected","version":"93f116c3393a22acab96ad1bef12b2572eb80ca4","versionType":"git"},{"lessThan":"a36e5e800b9c93e3e1ffa42f34d38b36775dbcee","status":"affected","version":"e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d","versionType":"git"},{"lessThan":"7de4d46be40738c7e48e64b5cc0a34aa1e047b0a","status":"affected","version":"85acaba2f42b557499bab3608307f17bf13beb69","versionType":"git"},{"lessThan":"e002e92e88e12457373ed096b18716d97e7bbb20","status":"affected","version":"ec35c1969650e7cb6c8a91020e568ed46e3551b0","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.12.81","status":"affected","version":"6.12.78","versionType":"semver"},{"lessThan":"6.18.22","status":"affected","version":"6.18.19","versionType":"semver"},{"lessThan":"6.19.12","status":"affected","version":"6.19.9","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3567D859-58AE-4093-AF8D-4FAF8C4F6486","versionEndExcluding":"6.12.81","versionStartIncluding":"6.12.78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FFB8FEEE-92ED-46DD-897B-15F8534FE743","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F44F6C4F-96C5-4F3A-8DA1-9B8F6AB14C51","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo\n\nCommit ec35c1969650 (\"usb: gadget: f_ncm: Fix net_device lifecycle with\ndevice_move\") reparents the gadget device to /sys/devices/virtual during\nunbind, clearing the gadget pointer. If the userspace tool queries on\nthe surviving interface during this detached window, this leads to a\nNULL pointer dereference.\n\nUnable to handle kernel NULL pointer dereference\nCall trace:\n eth_get_drvinfo+0x50/0x90\n ethtool_get_drvinfo+0x5c/0x1f0\n __dev_ethtool+0xaec/0x1fe0\n dev_ethtool+0x134/0x2e0\n dev_ioctl+0x338/0x560\n\nAdd a NULL check for dev->gadget in eth_get_drvinfo(). When detached,\nskip copying the fw_version and bus_info strings, which is natively\nhandled by ethtool_get_drvinfo for empty strings."}],"id":"CVE-2026-31727","lastModified":"2026-06-19T13:16:27.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.210","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f9f987472f4b8ab177be2b6492a59278ed969479","status":"affected","version":"7c97366f5dac5255e60a317ffe3a5b18f3745547","versionType":"git"},{"lessThan":"7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2","status":"affected","version":"36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4","versionType":"git"},{"lessThan":"0326429e8ba99892e1d1e115dc8e88e1a3b64e24","status":"affected","version":"93f116c3393a22acab96ad1bef12b2572eb80ca4","versionType":"git"},{"lessThan":"a36e5e800b9c93e3e1ffa42f34d38b36775dbcee","status":"affected","version":"e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d","versionType":"git"},{"lessThan":"7de4d46be40738c7e48e64b5cc0a34aa1e047b0a","status":"affected","version":"85acaba2f42b557499bab3608307f17bf13beb69","versionType":"git"},{"lessThan":"e002e92e88e12457373ed096b18716d97e7bbb20","status":"affected","version":"ec35c1969650e7cb6c8a91020e568ed46e3551b0","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.12.81","status":"affected","version":"6.12.78","versionType":"semver"},{"lessThan":"6.18.22","status":"affected","version":"6.18.19","versionType":"semver"},{"lessThan":"6.19.12","status":"affected","version":"6.19.9","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3567D859-58AE-4093-AF8D-4FAF8C4F6486","versionEndExcluding":"6.12.81","versionStartIncluding":"6.12.78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FFB8FEEE-92ED-46DD-897B-15F8534FE743","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F44F6C4F-96C5-4F3A-8DA1-9B8F6AB14C51","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo\n\nCommit ec35c1969650 (\"usb: gadget: f_ncm: Fix net_device lifecycle with\ndevice_move\") reparents the gadget device to /sys/devices/virtual during\nunbind, clearing the gadget pointer. If the userspace tool queries on\nthe surviving interface during this detached window, this leads to a\nNULL pointer dereference.\n\nUnable to handle kernel NULL pointer dereference\nCall trace:\n eth_get_drvinfo+0x50/0x90\n ethtool_get_drvinfo+0x5c/0x1f0\n __dev_ethtool+0xaec/0x1fe0\n dev_ethtool+0x134/0x2e0\n dev_ioctl+0x338/0x560\n\nAdd a NULL check for dev->gadget in eth_get_drvinfo(). When detached,\nskip copying the fw_version and bus_info strings, which is natively\nhandled by ethtool_get_drvinfo for empty strings."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: u_ether: Corrige desreferencia de puntero NULL en eth_get_drvinfo\n\nEl commit ec35c1969650 (’usb: gadget: f_ncm: Corrige el ciclo de vida de net_device con device_move’) reparenta el dispositivo gadget a /sys/devices/virtual durante la desvinculación, borrando el puntero gadget. Si la herramienta de espacio de usuario consulta en la interfaz superviviente durante esta ventana de desconexión, esto lleva a una desreferencia de puntero NULL.\n\nNo se puede manejar la desreferencia de puntero NULL del kernel\nRastreo de llamadas:\n eth_get_drvinfo+0x50/0x90\n ethtool_get_drvinfo+0x5c/0x1f0\n __dev_ethtool+0xaec/0x 1fe0\n dev_ethtool+0x134/0x2e0\n dev_ioctl+0x338/0x560\n\nAñadir una comprobación de NULL para dev  ->  gadget en eth_get_drvinfo(). Cuando está desconectado, omitir la copia de las cadenas fw_version y bus_info, lo cual es manejado de forma nativa por ethtool_get_drvinfo para cadenas vacías."}],"id":"CVE-2026-31727","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.210","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31728.json b/data/2026/CVE-2026-31728.json
index e3c5a68a0f..5aa060695b 100644
--- a/data/2026/CVE-2026-31728.json
+++ b/data/2026/CVE-2026-31728.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f02980594deef751e42133714aee25228f1494c6","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"e1e7a66584bf0aff3becb73c19fa31527889fc9e","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"a259ba0bce3b192c04334499690372a250f7d0b1","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"f6813c2b2ae78def76b69e0f9d72f80e4a1c4aca","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"bbb09bb89ffa571475f66daca9482b974cd29d6a","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"6ad77458637b78ec655e3da5f112c862e6690a9d","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"8ff689edfeceb5e3ec1623e09af2b2aa0f1098a8","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"e1eabb072c75681f78312c484ccfffb7430f206e","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.27"},{"lessThan":"2.6.27","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A01FA99D-A279-4156-BCB7-C23B63339A60","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix race between gether_disconnect and eth_stop\n\nA race condition between gether_disconnect() and eth_stop() leads to a\nNULL pointer dereference. Specifically, if eth_stop() is triggered\nconcurrently while gether_disconnect() is tearing down the endpoints,\neth_stop() attempts to access the cleared endpoint descriptor, causing\nthe following NPE:\n\n  Unable to handle kernel NULL pointer dereference\n  Call trace:\n   __dwc3_gadget_ep_enable+0x60/0x788\n   dwc3_gadget_ep_enable+0x70/0xe4\n   usb_ep_enable+0x60/0x15c\n   eth_stop+0xb8/0x108\n\nBecause eth_stop() crashes while holding the dev->lock, the thread\nrunning gether_disconnect() fails to acquire the same lock and spins\nforever, resulting in a hardlockup:\n\n  Core - Debugging Information for Hardlockup core(7)\n  Call trace:\n   queued_spin_lock_slowpath+0x94/0x488\n   _raw_spin_lock+0x64/0x6c\n   gether_disconnect+0x19c/0x1e8\n   ncm_set_alt+0x68/0x1a0\n   composite_setup+0x6a0/0xc50\n\nThe root cause is that the clearing of dev->port_usb in\ngether_disconnect() is delayed until the end of the function.\n\nMove the clearing of dev->port_usb to the very beginning of\ngether_disconnect() while holding dev->lock. This cuts off the link\nimmediately, ensuring eth_stop() will see dev->port_usb as NULL and\nsafely bail out."}],"id":"CVE-2026-31728","lastModified":"2026-06-17T10:34:19.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.333","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6ad77458637b78ec655e3da5f112c862e6690a9d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ff689edfeceb5e3ec1623e09af2b2aa0f1098a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a259ba0bce3b192c04334499690372a250f7d0b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbb09bb89ffa571475f66daca9482b974cd29d6a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1e7a66584bf0aff3becb73c19fa31527889fc9e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1eabb072c75681f78312c484ccfffb7430f206e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f02980594deef751e42133714aee25228f1494c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6813c2b2ae78def76b69e0f9d72f80e4a1c4aca"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f02980594deef751e42133714aee25228f1494c6","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"e1e7a66584bf0aff3becb73c19fa31527889fc9e","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"a259ba0bce3b192c04334499690372a250f7d0b1","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"f6813c2b2ae78def76b69e0f9d72f80e4a1c4aca","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"bbb09bb89ffa571475f66daca9482b974cd29d6a","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"6ad77458637b78ec655e3da5f112c862e6690a9d","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"8ff689edfeceb5e3ec1623e09af2b2aa0f1098a8","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"},{"lessThan":"e1eabb072c75681f78312c484ccfffb7430f206e","status":"affected","version":"2b3d942c4878084a37991a65e66512c02b8fa2ad","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/u_ether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.27"},{"lessThan":"2.6.27","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A01FA99D-A279-4156-BCB7-C23B63339A60","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix race between gether_disconnect and eth_stop\n\nA race condition between gether_disconnect() and eth_stop() leads to a\nNULL pointer dereference. Specifically, if eth_stop() is triggered\nconcurrently while gether_disconnect() is tearing down the endpoints,\neth_stop() attempts to access the cleared endpoint descriptor, causing\nthe following NPE:\n\n  Unable to handle kernel NULL pointer dereference\n  Call trace:\n   __dwc3_gadget_ep_enable+0x60/0x788\n   dwc3_gadget_ep_enable+0x70/0xe4\n   usb_ep_enable+0x60/0x15c\n   eth_stop+0xb8/0x108\n\nBecause eth_stop() crashes while holding the dev->lock, the thread\nrunning gether_disconnect() fails to acquire the same lock and spins\nforever, resulting in a hardlockup:\n\n  Core - Debugging Information for Hardlockup core(7)\n  Call trace:\n   queued_spin_lock_slowpath+0x94/0x488\n   _raw_spin_lock+0x64/0x6c\n   gether_disconnect+0x19c/0x1e8\n   ncm_set_alt+0x68/0x1a0\n   composite_setup+0x6a0/0xc50\n\nThe root cause is that the clearing of dev->port_usb in\ngether_disconnect() is delayed until the end of the function.\n\nMove the clearing of dev->port_usb to the very beginning of\ngether_disconnect() while holding dev->lock. This cuts off the link\nimmediately, ensuring eth_stop() will see dev->port_usb as NULL and\nsafely bail out."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: u_ether: Corrige condición de carrera entre gether_disconnect y eth_stop\n\nUna condición de carrera entre gether_disconnect() y eth_stop() conduce a una desreferencia de puntero NULL. Específicamente, si eth_stop() se activa concurrentemente mientras gether_disconnect() está desmantelando los puntos finales, eth_stop() intenta acceder al descriptor de punto final borrado, causando el siguiente NPE:\n\n  No se puede manejar la desreferencia de puntero NULL del kernel\n  Rastro de llamada:\n   __dwc3_gadget_ep_enable+0x60/0x788\n   dwc3_gadget_ep_enable+0x70/0xe4\n   usb_ep_enable+0x60/0x15c\n   eth_stop+0xb8/0x108\n\nDebido a que eth_stop() falla mientras mantiene el dev  ->  lock, el hilo que ejecuta gether_disconnect() no logra adquirir el mismo bloqueo y gira indefinidamente, resultando en un bloqueo total:\n\n  Núcleo - Información de depuración para bloqueo total del núcleo (7)\n  Rastro de llamada:\n   queued_spin_lock_slowpath+0x94/0x488\n   _raw_spin_lock+0x64/0x6c\n   gether_disconnect+0x19c/0x1e8\n   ncm_set_alt+0x68/0x1a0\n   composite_setup+0x6a0/0xc50\n\nLa causa raíz es que el borrado de dev  ->  port_usb en gether_disconnect() se retrasa hasta el final de la función.\n\nMover el borrado de dev  ->  port_usb al principio de gether_disconnect() mientras se mantiene dev  ->  lock. Esto corta el enlace inmediatamente, asegurando que eth_stop() verá dev  ->  port_usb como NULL y saldrá de forma segura."}],"id":"CVE-2026-31728","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.333","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6ad77458637b78ec655e3da5f112c862e6690a9d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ff689edfeceb5e3ec1623e09af2b2aa0f1098a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a259ba0bce3b192c04334499690372a250f7d0b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbb09bb89ffa571475f66daca9482b974cd29d6a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1e7a66584bf0aff3becb73c19fa31527889fc9e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1eabb072c75681f78312c484ccfffb7430f206e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f02980594deef751e42133714aee25228f1494c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6813c2b2ae78def76b69e0f9d72f80e4a1c4aca"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31729.json b/data/2026/CVE-2026-31729.json
index aab96ef4d6..46add3797e 100644
--- a/data/2026/CVE-2026-31729.json
+++ b/data/2026/CVE-2026-31729.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/typec/ucsi/ucsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f6dcbf2b024d55549959402f1db6c614e51d52cb","status":"affected","version":"bdc62f2bae8fb0e8e99574de5232f0a3c54a27df","versionType":"git"},{"lessThan":"f4e608fe12b7ac6a4a57176ab0296bb5a110a078","status":"affected","version":"bdc62f2bae8fb0e8e99574de5232f0a3c54a27df","versionType":"git"},{"lessThan":"98429e9ec89a5e3a204112dfaa2dbe6ca28493a0","status":"affected","version":"bdc62f2bae8fb0e8e99574de5232f0a3c54a27df","versionType":"git"},{"lessThan":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","status":"affected","version":"bdc62f2bae8fb0e8e99574de5232f0a3c54a27df","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/typec/ucsi/ucsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D1C17227-02C7-4A55-A9E6-1F88A48429E5","versionEndExcluding":"6.12.81","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: validate connector number in ucsi_notify_common()\n\nThe connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a\n7-bit field (0-127) that is used to index into the connector array in\nucsi_connector_change(). However, the array is only allocated for the\nnumber of connectors reported by the device (typically 2-4 entries).\n\nA malicious or malfunctioning device could report an out-of-range\nconnector number in the CCI, causing an out-of-bounds array access in\nucsi_connector_change().\n\nAdd a bounds check in ucsi_notify_common(), the central point where CCI\nis parsed after arriving from hardware, so that bogus connector numbers\nare rejected before they propagate further."}],"id":"CVE-2026-31729","lastModified":"2026-11-06T16:18:08.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31729","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:39.973230Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:35.467","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98429e9ec89a5e3a204112dfaa2dbe6ca28493a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4e608fe12b7ac6a4a57176ab0296bb5a110a078"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6dcbf2b024d55549959402f1db6c614e51d52cb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/typec/ucsi/ucsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f6dcbf2b024d55549959402f1db6c614e51d52cb","status":"affected","version":"bdc62f2bae8fb0e8e99574de5232f0a3c54a27df","versionType":"git"},{"lessThan":"f4e608fe12b7ac6a4a57176ab0296bb5a110a078","status":"affected","version":"bdc62f2bae8fb0e8e99574de5232f0a3c54a27df","versionType":"git"},{"lessThan":"98429e9ec89a5e3a204112dfaa2dbe6ca28493a0","status":"affected","version":"bdc62f2bae8fb0e8e99574de5232f0a3c54a27df","versionType":"git"},{"lessThan":"d2d8c17ac01a1b1f638ea5d340a884ccc5015186","status":"affected","version":"bdc62f2bae8fb0e8e99574de5232f0a3c54a27df","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/typec/ucsi/ucsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D1C17227-02C7-4A55-A9E6-1F88A48429E5","versionEndExcluding":"6.12.81","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: validate connector number in ucsi_notify_common()\n\nThe connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a\n7-bit field (0-127) that is used to index into the connector array in\nucsi_connector_change(). However, the array is only allocated for the\nnumber of connectors reported by the device (typically 2-4 entries).\n\nA malicious or malfunctioning device could report an out-of-range\nconnector number in the CCI, causing an out-of-bounds array access in\nucsi_connector_change().\n\nAdd a bounds check in ucsi_notify_common(), the central point where CCI\nis parsed after arriving from hardware, so that bogus connector numbers\nare rejected before they propagate further."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: typec: ucsi: validar número de conector en ucsi_notify_common()\n\nEl número de conector extraído de CCI a través de UCSI_CCI_CONNECTOR() es un campo de 7 bits (0-127) que se utiliza para indexar en el array de conectores en ucsi_connector_change(). Sin embargo, el array solo se asigna para el número de conectores reportados por el dispositivo (típicamente 2-4 entradas).\n\nUn dispositivo malicioso o que funciona mal podría reportar un número de conector fuera de rango en el CCI, causando un acceso a array fuera de límites en ucsi_connector_change().\n\nAñadir una comprobación de límites en ucsi_notify_common(), el punto central donde se analiza el CCI después de llegar del hardware, para que los números de conector falsos sean rechazados antes de que se propaguen más."}],"id":"CVE-2026-31729","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31729","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:39.973230Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:35.467","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98429e9ec89a5e3a204112dfaa2dbe6ca28493a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2d8c17ac01a1b1f638ea5d340a884ccc5015186"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4e608fe12b7ac6a4a57176ab0296bb5a110a078"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6dcbf2b024d55549959402f1db6c614e51d52cb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31730.json b/data/2026/CVE-2026-31730.json
index 0622fc28f3..7668f3d043 100644
--- a/data/2026/CVE-2026-31730.json
+++ b/data/2026/CVE-2026-31730.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/misc/fastrpc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b8e527aca357a6488680713bd88007cf8f547fe","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"},{"lessThan":"0bdee4118340c5a756220c1b29a7dab86bb0aa65","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"},{"lessThan":"3a164f640953cc982804746e772d379171aff5c6","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"},{"lessThan":"f67d368d26764a357691b2b3a33d3cb55b435bfc","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"},{"lessThan":"ba2c83167b215da30fa2aae56b140198cf8d8408","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/misc/fastrpc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: possible double-free of cctx->remote_heap\n\nfastrpc_init_create_static_process() may free cctx->remote_heap on the\nerr_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove()\nfrees cctx->remote_heap again if it is non-NULL, which can lead to a\ndouble-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg\ndevice is subsequently removed/unbound.\nClear cctx->remote_heap after freeing it in the error path to prevent the\nlater cleanup from freeing it again.\n\nThis issue was found by an in-house analysis workflow that extracts AST-based\ninformation and runs static checks, with LLM assistance for triage, and was\nconfirmed by manual code review.\nNo hardware testing was performed."}],"id":"CVE-2026-31730","lastModified":"2026-06-17T10:34:19.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0bdee4118340c5a756220c1b29a7dab86bb0aa65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a164f640953cc982804746e772d379171aff5c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b8e527aca357a6488680713bd88007cf8f547fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba2c83167b215da30fa2aae56b140198cf8d8408"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f67d368d26764a357691b2b3a33d3cb55b435bfc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/misc/fastrpc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b8e527aca357a6488680713bd88007cf8f547fe","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"},{"lessThan":"0bdee4118340c5a756220c1b29a7dab86bb0aa65","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"},{"lessThan":"3a164f640953cc982804746e772d379171aff5c6","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"},{"lessThan":"f67d368d26764a357691b2b3a33d3cb55b435bfc","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"},{"lessThan":"ba2c83167b215da30fa2aae56b140198cf8d8408","status":"affected","version":"0871561055e666da421d779397efcc1e5e964cab","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/misc/fastrpc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: possible double-free of cctx->remote_heap\n\nfastrpc_init_create_static_process() may free cctx->remote_heap on the\nerr_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove()\nfrees cctx->remote_heap again if it is non-NULL, which can lead to a\ndouble-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg\ndevice is subsequently removed/unbound.\nClear cctx->remote_heap after freeing it in the error path to prevent the\nlater cleanup from freeing it again.\n\nThis issue was found by an in-house analysis workflow that extracts AST-based\ninformation and runs static checks, with LLM assistance for triage, and was\nconfirmed by manual code review.\nNo hardware testing was performed."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmisc: fastrpc: posible doble liberación de cctx  ->  remote_heap\n\nfastrpc_init_create_static_process() puede liberar cctx  ->  remote_heap en la ruta err_map pero no borra el puntero. Más tarde, fastrpc_rpmsg_remove() libera cctx  ->  remote_heap de nuevo si no es NULL, lo que puede llevar a una doble liberación si el ioctl INIT_CREATE_STATIC alcanza la ruta de error y el dispositivo rpmsg es posteriormente eliminado/desvinculado.\nBorrar cctx  ->  remote_heap después de liberarlo en la ruta de error para evitar que la limpieza posterior lo libere de nuevo.\n\nEste problema fue encontrado por un flujo de trabajo de análisis interno que extrae información basada en AST y ejecuta comprobaciones estáticas, con asistencia de LLM para el triaje, y fue confirmado por una revisión manual del código.\nNo se realizaron pruebas de hardware."}],"id":"CVE-2026-31730","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0bdee4118340c5a756220c1b29a7dab86bb0aa65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a164f640953cc982804746e772d379171aff5c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b8e527aca357a6488680713bd88007cf8f547fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba2c83167b215da30fa2aae56b140198cf8d8408"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f67d368d26764a357691b2b3a33d3cb55b435bfc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31731.json b/data/2026/CVE-2026-31731.json
index 9b59be3ce0..42a391817c 100644
--- a/data/2026/CVE-2026-31731.json
+++ b/data/2026/CVE-2026-31731.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/thermal/thermal_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1a6d2b001eb730d85f00da39ae7db6f3b4edc540","status":"affected","version":"5a5efdaffda5d23717d9117cf36cda9eafcf2fae","versionType":"git"},{"lessThan":"2dbe93f344f10b432b95a23304006be805c097a1","status":"affected","version":"5a5efdaffda5d23717d9117cf36cda9eafcf2fae","versionType":"git"},{"lessThan":"c4593f1654f7dea3bcf9bb1851ded86311d4f370","status":"affected","version":"5a5efdaffda5d23717d9117cf36cda9eafcf2fae","versionType":"git"},{"lessThan":"45b859b0728267a6199ee5002d62e6c6f3e8c89d","status":"affected","version":"5a5efdaffda5d23717d9117cf36cda9eafcf2fae","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/thermal/thermal_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4065C9A5-AA06-4747-8C07-BDBC1E8C0051","versionEndExcluding":"6.12.83","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Address thermal zone removal races with resume\n\nSince thermal_zone_pm_complete() and thermal_zone_device_resume()\nre-initialize the poll_queue delayed work for the given thermal zone,\nthe cancel_delayed_work_sync() in thermal_zone_device_unregister()\nmay miss some already running work items and the thermal zone may\nbe freed prematurely [1].\n\nThere are two failing scenarios that both start with\nrunning thermal_pm_notify_complete() right before invoking\nthermal_zone_device_unregister() for one of the thermal zones.\n\nIn the first scenario, there is a work item already running for\nthe given thermal zone when thermal_pm_notify_complete() calls\nthermal_zone_pm_complete() for that thermal zone and it continues to\nrun when thermal_zone_device_unregister() starts.  Since the poll_queue\ndelayed work has been re-initialized by thermal_pm_notify_complete(), the\nrunning work item will be missed by the cancel_delayed_work_sync() in\nthermal_zone_device_unregister() and if it continues to run past the\nfreeing of the thermal zone object, a use-after-free will occur.\n\nIn the second scenario, thermal_zone_device_resume() queued up by\nthermal_pm_notify_complete() runs right after the thermal_zone_exit()\ncalled by thermal_zone_device_unregister() has returned.  The poll_queue\ndelayed work is re-initialized by it before cancel_delayed_work_sync() is\ncalled by thermal_zone_device_unregister(), so it may continue to run\nafter the freeing of the thermal zone object, which also leads to a\nuse-after-free.\n\nAddress the first failing scenario by ensuring that no thermal work\nitems will be running when thermal_pm_notify_complete() is called.\nFor this purpose, first move the cancel_delayed_work() call from\nthermal_zone_pm_complete() to thermal_zone_pm_prepare() to prevent\nnew work from entering the workqueue going forward.  Next, switch\nover to using a dedicated workqueue for thermal events and update\nthe code in thermal_pm_notify() to flush that workqueue after\nthermal_pm_notify_prepare() has returned which will take care of\nall leftover thermal work already on the workqueue (that leftover\nwork would do nothing useful anyway because all of the thermal zones\nhave been flagged as suspended).\n\nThe second failing scenario is addressed by adding a tz->state check\nto thermal_zone_device_resume() to prevent it from re-initializing\nthe poll_queue delayed work if the thermal zone is going away.\n\nNote that the above changes will also facilitate relocating the suspend\nand resume of thermal zones closer to the suspend and resume of devices,\nrespectively."}],"id":"CVE-2026-31731","lastModified":"2026-10-19T20:17:57.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31731","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:52.594804Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:35.683","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a6d2b001eb730d85f00da39ae7db6f3b4edc540"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2dbe93f344f10b432b95a23304006be805c097a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45b859b0728267a6199ee5002d62e6c6f3e8c89d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4593f1654f7dea3bcf9bb1851ded86311d4f370"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/thermal/thermal_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1a6d2b001eb730d85f00da39ae7db6f3b4edc540","status":"affected","version":"5a5efdaffda5d23717d9117cf36cda9eafcf2fae","versionType":"git"},{"lessThan":"2dbe93f344f10b432b95a23304006be805c097a1","status":"affected","version":"5a5efdaffda5d23717d9117cf36cda9eafcf2fae","versionType":"git"},{"lessThan":"c4593f1654f7dea3bcf9bb1851ded86311d4f370","status":"affected","version":"5a5efdaffda5d23717d9117cf36cda9eafcf2fae","versionType":"git"},{"lessThan":"45b859b0728267a6199ee5002d62e6c6f3e8c89d","status":"affected","version":"5a5efdaffda5d23717d9117cf36cda9eafcf2fae","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/thermal/thermal_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4065C9A5-AA06-4747-8C07-BDBC1E8C0051","versionEndExcluding":"6.12.83","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Address thermal zone removal races with resume\n\nSince thermal_zone_pm_complete() and thermal_zone_device_resume()\nre-initialize the poll_queue delayed work for the given thermal zone,\nthe cancel_delayed_work_sync() in thermal_zone_device_unregister()\nmay miss some already running work items and the thermal zone may\nbe freed prematurely [1].\n\nThere are two failing scenarios that both start with\nrunning thermal_pm_notify_complete() right before invoking\nthermal_zone_device_unregister() for one of the thermal zones.\n\nIn the first scenario, there is a work item already running for\nthe given thermal zone when thermal_pm_notify_complete() calls\nthermal_zone_pm_complete() for that thermal zone and it continues to\nrun when thermal_zone_device_unregister() starts.  Since the poll_queue\ndelayed work has been re-initialized by thermal_pm_notify_complete(), the\nrunning work item will be missed by the cancel_delayed_work_sync() in\nthermal_zone_device_unregister() and if it continues to run past the\nfreeing of the thermal zone object, a use-after-free will occur.\n\nIn the second scenario, thermal_zone_device_resume() queued up by\nthermal_pm_notify_complete() runs right after the thermal_zone_exit()\ncalled by thermal_zone_device_unregister() has returned.  The poll_queue\ndelayed work is re-initialized by it before cancel_delayed_work_sync() is\ncalled by thermal_zone_device_unregister(), so it may continue to run\nafter the freeing of the thermal zone object, which also leads to a\nuse-after-free.\n\nAddress the first failing scenario by ensuring that no thermal work\nitems will be running when thermal_pm_notify_complete() is called.\nFor this purpose, first move the cancel_delayed_work() call from\nthermal_zone_pm_complete() to thermal_zone_pm_prepare() to prevent\nnew work from entering the workqueue going forward.  Next, switch\nover to using a dedicated workqueue for thermal events and update\nthe code in thermal_pm_notify() to flush that workqueue after\nthermal_pm_notify_prepare() has returned which will take care of\nall leftover thermal work already on the workqueue (that leftover\nwork would do nothing useful anyway because all of the thermal zones\nhave been flagged as suspended).\n\nThe second failing scenario is addressed by adding a tz->state check\nto thermal_zone_device_resume() to prevent it from re-initializing\nthe poll_queue delayed work if the thermal zone is going away.\n\nNote that the above changes will also facilitate relocating the suspend\nand resume of thermal zones closer to the suspend and resume of devices,\nrespectively."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nthermal: core: Abordar las condiciones de carrera en la eliminación de zonas térmicas con la reanudación\n\nDado que thermal_zone_pm_complete() y thermal_zone_device_resume() reinicializan el trabajo retrasado de poll_queue para la zona térmica dada, el cancel_delayed_work_sync() en thermal_zone_device_unregister() puede pasar por alto algunos elementos de trabajo ya en ejecución y la zona térmica puede ser liberada prematuramente [1].\n\nHay dos escenarios de fallo que ambos comienzan con la ejecución de thermal_pm_notify_complete() justo antes de invocar thermal_zone_device_unregister() para una de las zonas térmicas.\n\nEn el primer escenario, hay un elemento de trabajo ya en ejecución para la zona térmica dada cuando thermal_pm_notify_complete() llama a thermal_zone_pm_complete() para esa zona térmica y continúa ejecutándose cuando thermal_zone_device_unregister() comienza. Dado que el trabajo retrasado de poll_queue ha sido reinicializado por thermal_pm_notify_complete(), el elemento de trabajo en ejecución será pasado por alto por el cancel_delayed_work_sync() en thermal_zone_device_unregister() y si continúa ejecutándose después de la liberación del objeto de la zona térmica, ocurrirá un uso después de liberación.\n\nEn el segundo escenario, thermal_zone_device_resume() encolado por thermal_pm_notify_complete() se ejecuta justo después de que thermal_zone_exit() llamado por thermal_zone_device_unregister() haya regresado. El trabajo retrasado de poll_queue es reinicializado por este antes de que cancel_delayed_work_sync() sea llamado por thermal_zone_device_unregister(), por lo que puede continuar ejecutándose después de la liberación del objeto de la zona térmica, lo que también conduce a un uso después de liberación.\n\nAbordar el primer escenario de fallo asegurando que ningún elemento de trabajo térmico estará en ejecución cuando se llame a thermal_pm_notify_complete(). Para este propósito, primero mover la llamada a cancel_delayed_work() de thermal_zone_pm_complete() a thermal_zone_pm_prepare() para evitar que nuevo trabajo entre en la cola de trabajo en adelante. A continuación, cambiar a usar una cola de trabajo dedicada para eventos térmicos y actualizar el código en thermal_pm_notify() para vaciar esa cola de trabajo después de que thermal_pm_notify_prepare() haya regresado, lo que se encargará de todo el trabajo térmico restante ya en la cola de trabajo (ese trabajo restante no haría nada útil de todos modos porque todas las zonas térmicas han sido marcadas como suspendidas).\n\nEl segundo escenario de fallo se aborda añadiendo una comprobación de tz  ->  state a thermal_zone_device_resume() para evitar que reinicialice el trabajo retrasado de poll_queue si la zona térmica está desapareciendo.\n\nTenga en cuenta que los cambios anteriores también facilitarán la reubicación de la suspensión y reanudación de las zonas térmicas más cerca de la suspensión y reanudación de los dispositivos, respectivamente."}],"id":"CVE-2026-31731","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31731","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:52.594804Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:35.683","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a6d2b001eb730d85f00da39ae7db6f3b4edc540"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2dbe93f344f10b432b95a23304006be805c097a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45b859b0728267a6199ee5002d62e6c6f3e8c89d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4593f1654f7dea3bcf9bb1851ded86311d4f370"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31732.json b/data/2026/CVE-2026-31732.json
index 6245bd4972..412421d8e5 100644
--- a/data/2026/CVE-2026-31732.json
+++ b/data/2026/CVE-2026-31732.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpio/gpiolib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a500e1837c4266ddb05b39b3e1cc71f49a43ffa5","status":"affected","version":"aab5c6f200238ac45001bec3d5494fff8438a8dc","versionType":"git"},{"lessThan":"f0cf9c7b7c281956cc0dec163132cd96f76e1d60","status":"affected","version":"aab5c6f200238ac45001bec3d5494fff8438a8dc","versionType":"git"},{"lessThan":"fb4584d2b324c522404c733c65840a1a6519ada8","status":"affected","version":"aab5c6f200238ac45001bec3d5494fff8438a8dc","versionType":"git"},{"lessThan":"16fdabe143fce2cbf89139677728e17e21b46c28","status":"affected","version":"aab5c6f200238ac45001bec3d5494fff8438a8dc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpio/gpiolib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"21ACBF2B-16E4-4D78-AB62-463FB9D3152C","versionEndExcluding":"6.18.22","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: Fix resource leaks on errors in gpiochip_add_data_with_key()\n\nSince commit aab5c6f20023 (\"gpio: set device type for GPIO chips\"),\n`gdev->dev.release` is unset.  As a result, the reference count to\n`gdev->dev` isn't dropped on the error handling paths.\n\nDrop the reference on errors.\n\nAlso reorder the instructions to make the error handling simpler.\nNow gpiochip_add_data_with_key() roughly looks like:\n\n   >>> Some memory allocation.  Go to ERR ZONE 1 on errors.\n   >>> device_initialize().\n\n   gpiodev_release() takes over the responsibility for freeing the\n   resources of `gdev->dev`.  The subsequent error handling paths\n   shouldn't go through ERR ZONE 1 again which leads to double free.\n\n   >>> Some initialization mainly on `gdev`.\n   >>> The rest of initialization.  Go to ERR ZONE 2 on errors.\n   >>> Chip registration success and exit.\n\n   >>> ERR ZONE 2.  gpio_device_put() and exit.\n   >>> ERR ZONE 1."}],"id":"CVE-2026-31732","lastModified":"2026-07-04T12:16:55.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.807","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16fdabe143fce2cbf89139677728e17e21b46c28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a500e1837c4266ddb05b39b3e1cc71f49a43ffa5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f0cf9c7b7c281956cc0dec163132cd96f76e1d60"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb4584d2b324c522404c733c65840a1a6519ada8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpio/gpiolib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a500e1837c4266ddb05b39b3e1cc71f49a43ffa5","status":"affected","version":"aab5c6f200238ac45001bec3d5494fff8438a8dc","versionType":"git"},{"lessThan":"f0cf9c7b7c281956cc0dec163132cd96f76e1d60","status":"affected","version":"aab5c6f200238ac45001bec3d5494fff8438a8dc","versionType":"git"},{"lessThan":"fb4584d2b324c522404c733c65840a1a6519ada8","status":"affected","version":"aab5c6f200238ac45001bec3d5494fff8438a8dc","versionType":"git"},{"lessThan":"16fdabe143fce2cbf89139677728e17e21b46c28","status":"affected","version":"aab5c6f200238ac45001bec3d5494fff8438a8dc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpio/gpiolib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"21ACBF2B-16E4-4D78-AB62-463FB9D3152C","versionEndExcluding":"6.18.22","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: Fix resource leaks on errors in gpiochip_add_data_with_key()\n\nSince commit aab5c6f20023 (\"gpio: set device type for GPIO chips\"),\n`gdev->dev.release` is unset.  As a result, the reference count to\n`gdev->dev` isn't dropped on the error handling paths.\n\nDrop the reference on errors.\n\nAlso reorder the instructions to make the error handling simpler.\nNow gpiochip_add_data_with_key() roughly looks like:\n\n   >>> Some memory allocation.  Go to ERR ZONE 1 on errors.\n   >>> device_initialize().\n\n   gpiodev_release() takes over the responsibility for freeing the\n   resources of `gdev->dev`.  The subsequent error handling paths\n   shouldn't go through ERR ZONE 1 again which leads to double free.\n\n   >>> Some initialization mainly on `gdev`.\n   >>> The rest of initialization.  Go to ERR ZONE 2 on errors.\n   >>> Chip registration success and exit.\n\n   >>> ERR ZONE 2.  gpio_device_put() and exit.\n   >>> ERR ZONE 1."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpio: Corrige fugas de recursos en errores en gpiochip_add_data_with_key()\n\nDesde el commit aab5c6f20023 (’gpio: establece el tipo de dispositivo para chips GPIO’),\n’gdev  ->  dev.release’ no está establecido. Como resultado, el recuento de referencias a\n’gdev  ->  dev’ no se libera en las rutas de manejo de errores.\n\nLibera la referencia en errores.\n\nTambién reordena las instrucciones para simplificar el manejo de errores.\nAhora gpiochip_add_data_with_key() se ve aproximadamente así:\n\n   >>> Alguna asignación de memoria. Ir a ZONA DE ERROR 1 en errores.\n   >>> device_initialize().\n\n   gpiodev_release() asume la responsabilidad de liberar los\n   recursos de ’gdev  ->  dev’. Las rutas de manejo de errores subsiguientes\n   no deberían pasar por ZONA DE ERROR 1 de nuevo, lo que lleva a una doble liberación.\n\n   >>> Alguna inicialización principalmente en ’gdev’.\n   >>> El resto de la inicialización. Ir a ZONA DE ERROR 2 en errores.\n   >>> Registro del chip exitoso y salida.\n\n   >>> ZONA DE ERROR 2. gpio_device_put() y salida.\n   >>> ZONA DE ERROR 1."}],"id":"CVE-2026-31732","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.807","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16fdabe143fce2cbf89139677728e17e21b46c28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a500e1837c4266ddb05b39b3e1cc71f49a43ffa5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f0cf9c7b7c281956cc0dec163132cd96f76e1d60"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb4584d2b324c522404c733c65840a1a6519ada8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31733.json b/data/2026/CVE-2026-31733.json
index f79d09edd6..b228929eaf 100644
--- a/data/2026/CVE-2026-31733.json
+++ b/data/2026/CVE-2026-31733.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/sched/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ca685511f7afd42cdcbb0feea42e5d332d384251","status":"affected","version":"5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9","versionType":"git"},{"lessThan":"5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5","status":"affected","version":"5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9","versionType":"git"},{"lessThan":"7ea601daa0153e19cd1c6e6b300348c70c05fe77","status":"affected","version":"5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9","versionType":"git"},{"lessThan":"7e0ffb72de8aa3b25989c2d980e81b829c577010","status":"affected","version":"5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/sched/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"12ED4499-597C-42BD-BD53-014753EC3EB0","versionEndExcluding":"6.12.82","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix stale direct dispatch state in ddsp_dsq_id\n\n@p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a\nspurious warning in mark_direct_dispatch() when the next wakeup's\nops.select_cpu() calls scx_bpf_dsq_insert(), such as:\n\n WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140\n\nThe root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(),\nwhich is not reached in all paths that consume or cancel a direct dispatch\nverdict.\n\nFix it by clearing it at the right places:\n\n - direct_dispatch(): cache the direct dispatch state in local variables\n   and clear it before dispatch_enqueue() on the synchronous path. For\n   the deferred path, the direct dispatch state must remain set until\n   process_ddsp_deferred_locals() consumes them.\n\n - process_ddsp_deferred_locals(): cache the dispatch state in local\n   variables and clear it before calling dispatch_to_local_dsq(), which\n   may migrate the task to another rq.\n\n - do_enqueue_task(): clear the dispatch state on the enqueue path\n   (local/global/bypass fallbacks), where the direct dispatch verdict is\n   ignored.\n\n - dequeue_task_scx(): clear the dispatch state after dispatch_dequeue()\n   to handle both the deferred dispatch cancellation and the holding_cpu\n   race, covering all cases where a pending direct dispatch is\n   cancelled.\n\n - scx_disable_task(): clear the direct dispatch state when\n   transitioning a task out of the current scheduler. Waking tasks may\n   have had the direct dispatch state set by the outgoing scheduler's\n   ops.select_cpu() and then been queued on a wake_list via\n   ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such\n   tasks are not on the runqueue and are not iterated by scx_bypass(),\n   so their direct dispatch state won't be cleared. Without this clear,\n   any subsequent SCX scheduler that tries to direct dispatch the task\n   will trigger the WARN_ON_ONCE() in mark_direct_dispatch()."}],"id":"CVE-2026-31733","lastModified":"2026-06-17T10:34:19.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.913","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e0ffb72de8aa3b25989c2d980e81b829c577010"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ea601daa0153e19cd1c6e6b300348c70c05fe77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca685511f7afd42cdcbb0feea42e5d332d384251"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/sched/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ca685511f7afd42cdcbb0feea42e5d332d384251","status":"affected","version":"5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9","versionType":"git"},{"lessThan":"5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5","status":"affected","version":"5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9","versionType":"git"},{"lessThan":"7ea601daa0153e19cd1c6e6b300348c70c05fe77","status":"affected","version":"5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9","versionType":"git"},{"lessThan":"7e0ffb72de8aa3b25989c2d980e81b829c577010","status":"affected","version":"5b26f7b920f76b2b9cc398c252a9e35e44bf5bb9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/sched/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"12ED4499-597C-42BD-BD53-014753EC3EB0","versionEndExcluding":"6.12.82","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix stale direct dispatch state in ddsp_dsq_id\n\n@p->scx.ddsp_dsq_id can be left set (non-SCX_DSQ_INVALID) triggering a\nspurious warning in mark_direct_dispatch() when the next wakeup's\nops.select_cpu() calls scx_bpf_dsq_insert(), such as:\n\n WARNING: kernel/sched/ext.c:1273 at scx_dsq_insert_commit+0xcd/0x140\n\nThe root cause is that ddsp_dsq_id was only cleared in dispatch_enqueue(),\nwhich is not reached in all paths that consume or cancel a direct dispatch\nverdict.\n\nFix it by clearing it at the right places:\n\n - direct_dispatch(): cache the direct dispatch state in local variables\n   and clear it before dispatch_enqueue() on the synchronous path. For\n   the deferred path, the direct dispatch state must remain set until\n   process_ddsp_deferred_locals() consumes them.\n\n - process_ddsp_deferred_locals(): cache the dispatch state in local\n   variables and clear it before calling dispatch_to_local_dsq(), which\n   may migrate the task to another rq.\n\n - do_enqueue_task(): clear the dispatch state on the enqueue path\n   (local/global/bypass fallbacks), where the direct dispatch verdict is\n   ignored.\n\n - dequeue_task_scx(): clear the dispatch state after dispatch_dequeue()\n   to handle both the deferred dispatch cancellation and the holding_cpu\n   race, covering all cases where a pending direct dispatch is\n   cancelled.\n\n - scx_disable_task(): clear the direct dispatch state when\n   transitioning a task out of the current scheduler. Waking tasks may\n   have had the direct dispatch state set by the outgoing scheduler's\n   ops.select_cpu() and then been queued on a wake_list via\n   ttwu_queue_wakelist(), when SCX_OPS_ALLOW_QUEUED_WAKEUP is set. Such\n   tasks are not on the runqueue and are not iterated by scx_bypass(),\n   so their direct dispatch state won't be cleared. Without this clear,\n   any subsequent SCX scheduler that tries to direct dispatch the task\n   will trigger the WARN_ON_ONCE() in mark_direct_dispatch()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched_ext: Corrige el estado obsoleto de despacho directo en ddsp_dsq_id\n\n@p  ->  scx.ddsp_dsq_id puede quedar establecido (no-SCX_DSQ_INVALID) desencadenando una advertencia espuria en mark_direct_dispatch() cuando el ops.select_cpu() de la siguiente activación llama a scx_bpf_dsq_insert(), como por ejemplo:\n\n ADVERTENCIA: kernel/sched/ext.c:1273 en scx_dsq_insert_commit+0xcd/0x140\n\nLa causa raíz es que ddsp_dsq_id solo se borraba en dispatch_enqueue(), que no se alcanza en todas las rutas que consumen o cancelan un veredicto de despacho directo.\n\nCorrígelo borrándolo en los lugares correctos:\n\n - direct_dispatch(): almacena en caché el estado de despacho directo en variables locales y bórralo antes de dispatch_enqueue() en la ruta síncrona. Para la ruta diferida, el estado de despacho directo debe permanecer establecido hasta que process_ddsp_deferred_locals() los consuma.\n\n - process_ddsp_deferred_locals(): almacena en caché el estado de despacho en variables locales y bórralo antes de llamar a dispatch_to_local_dsq(), lo que puede migrar la tarea a otra rq.\n\n - do_enqueue_task(): borra el estado de despacho en la ruta de encolamiento (alternativas local/global/bypass), donde el veredicto de despacho directo es ignorado.\n\n - dequeue_task_scx(): borra el estado de despacho después de dispatch_dequeue() para manejar tanto la cancelación de despacho diferido como la condición de carrera holding_cpu, cubriendo todos los casos en los que se cancela un despacho directo pendiente.\n\n - scx_disable_task(): borra el estado de despacho directo al hacer la transición de una tarea fuera del planificador actual. Las tareas que se activan pueden haber tenido el estado de despacho directo establecido por el ops.select_cpu() del planificador saliente y luego haber sido encoladas en una wake_list a través de ttwu_queue_wakelist(), cuando SCX_OPS_ALLOW_QUEUED_WAKEUP está establecido. Dichas tareas no están en la runqueue y no son iteradas por scx_bypass(), por lo que su estado de despacho directo no se borrará. Sin este borrado, cualquier planificador SCX subsiguiente que intente despachar directamente la tarea activará el WARN_ON_ONCE() en mark_direct_dispatch()."}],"id":"CVE-2026-31733","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:35.913","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e7b2cc8fae9ec2a5bc53311191d2faaff75a4b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e0ffb72de8aa3b25989c2d980e81b829c577010"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ea601daa0153e19cd1c6e6b300348c70c05fe77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca685511f7afd42cdcbb0feea42e5d332d384251"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31734.json b/data/2026/CVE-2026-31734.json
index 57d5d405fb..93ae9ba84b 100644
--- a/data/2026/CVE-2026-31734.json
+++ b/data/2026/CVE-2026-31734.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/sched/ext_idle.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"72c43eb2e334febe93018cfb68ae828f55c6e49e","status":"affected","version":"8e4f0b1ebcf2180ab594f204f01279a666dadf3b","versionType":"git"},{"lessThan":"b4992a9446bb9a639007bfd32bf5c5a7e30199e5","status":"affected","version":"8e4f0b1ebcf2180ab594f204f01279a666dadf3b","versionType":"git"},{"lessThan":"0c4a59df370bea245695c00aaae6ae75747139bd","status":"affected","version":"8e4f0b1ebcf2180ab594f204f01279a666dadf3b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/sched/ext_idle.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BFDF75B5-A823-4448-88D3-3029C0464168","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU\n\nSince commit 8e4f0b1ebcf2 (\"bpf: use rcu_read_lock_dont_migrate() for\ntrampoline.c\"), the BPF prolog (__bpf_prog_enter) calls migrate_disable()\nonly when CONFIG_PREEMPT_RCU is enabled, via rcu_read_lock_dont_migrate().\nWithout CONFIG_PREEMPT_RCU, the prolog never touches migration_disabled,\nso migration_disabled == 1 always means the task is truly\nmigration-disabled regardless of whether it is the current task.\n\nThe old unconditional p == current check was a false negative in this\ncase, potentially allowing a migration-disabled task to be dispatched to\na remote CPU and triggering scx_error in task_can_run_on_remote_rq().\n\nOnly apply the p == current disambiguation when CONFIG_PREEMPT_RCU is\nenabled, where the ambiguity with the BPF prolog still exists."}],"id":"CVE-2026-31734","lastModified":"2026-06-17T10:34:20.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.030","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c4a59df370bea245695c00aaae6ae75747139bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72c43eb2e334febe93018cfb68ae828f55c6e49e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b4992a9446bb9a639007bfd32bf5c5a7e30199e5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/sched/ext_idle.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"72c43eb2e334febe93018cfb68ae828f55c6e49e","status":"affected","version":"8e4f0b1ebcf2180ab594f204f01279a666dadf3b","versionType":"git"},{"lessThan":"b4992a9446bb9a639007bfd32bf5c5a7e30199e5","status":"affected","version":"8e4f0b1ebcf2180ab594f204f01279a666dadf3b","versionType":"git"},{"lessThan":"0c4a59df370bea245695c00aaae6ae75747139bd","status":"affected","version":"8e4f0b1ebcf2180ab594f204f01279a666dadf3b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/sched/ext_idle.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BFDF75B5-A823-4448-88D3-3029C0464168","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU\n\nSince commit 8e4f0b1ebcf2 (\"bpf: use rcu_read_lock_dont_migrate() for\ntrampoline.c\"), the BPF prolog (__bpf_prog_enter) calls migrate_disable()\nonly when CONFIG_PREEMPT_RCU is enabled, via rcu_read_lock_dont_migrate().\nWithout CONFIG_PREEMPT_RCU, the prolog never touches migration_disabled,\nso migration_disabled == 1 always means the task is truly\nmigration-disabled regardless of whether it is the current task.\n\nThe old unconditional p == current check was a false negative in this\ncase, potentially allowing a migration-disabled task to be dispatched to\na remote CPU and triggering scx_error in task_can_run_on_remote_rq().\n\nOnly apply the p == current disambiguation when CONFIG_PREEMPT_RCU is\nenabled, where the ambiguity with the BPF prolog still exists."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsched_ext: Solución de falso negativo en is_bpf_migration_disabled() en no-PREEMPT_RCU\n\nDesde el commit 8e4f0b1ebcf2 (’bpf: usar rcu_read_lock_dont_migrate() para trampoline.c’), el prólogo BPF (__bpf_prog_enter) llama a migrate_disable() solo cuando CONFIG_PREEMPT_RCU está habilitado, a través de rcu_read_lock_dont_migrate(). Sin CONFIG_PREEMPT_RCU, el prólogo nunca toca migration_disabled, por lo que migration_disabled == 1 siempre significa que la tarea tiene la migración verdaderamente deshabilitada, independientemente de si es la tarea actual.\n\nLa antigua comprobación incondicional p == current era un falso negativo en este caso, lo que potencialmente permitía que una tarea con la migración deshabilitada fuera despachada a una CPU remota y desencadenando scx_error en task_can_run_on_remote_rq().\n\nSolo aplicar la desambiguación p == current cuando CONFIG_PREEMPT_RCU está habilitado, donde la ambigüedad con el prólogo BPF aún existe."}],"id":"CVE-2026-31734","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.030","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c4a59df370bea245695c00aaae6ae75747139bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72c43eb2e334febe93018cfb68ae828f55c6e49e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b4992a9446bb9a639007bfd32bf5c5a7e30199e5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31735.json b/data/2026/CVE-2026-31735.json
index 005eb953ed..3b596c44fc 100644
--- a/data/2026/CVE-2026-31735.json
+++ b/data/2026/CVE-2026-31735.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iommu/generic_pt/iommu_pt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"50ecd96a28f712f8b682c0441f4cb9b086d28816","status":"affected","version":"7c53f4238aa8bfb476e177263133ead2eeb8d55d","versionType":"git"},{"lessThan":"ee6e69d032550687a3422504bfca3f834c7b5061","status":"affected","version":"7c53f4238aa8bfb476e177263133ead2eeb8d55d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iommu/generic_pt/iommu_pt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommupt: Fix short gather if the unmap goes into a large mapping\n\nunmap has the odd behavior that it can unmap more than requested if the\nending point lands within the middle of a large or contiguous IOPTE.\n\nIn this case the gather should flush everything unmapped which can be\nlarger than what was requested to be unmapped. The gather was only\nflushing the range requested to be unmapped, not extending to the extra\nrange, resulting in a short invalidation if the caller hits this special\ncondition.\n\nThis was found by the new invalidation/gather test I am adding in\npreparation for ARMv8. Claude deduced the root cause.\n\nAs far as I remember nothing relies on unmapping a large entry, so this is\nlikely not a triggerable bug."}],"id":"CVE-2026-31735","lastModified":"2026-06-17T10:34:20.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:36.140","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/50ecd96a28f712f8b682c0441f4cb9b086d28816"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee6e69d032550687a3422504bfca3f834c7b5061"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iommu/generic_pt/iommu_pt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"50ecd96a28f712f8b682c0441f4cb9b086d28816","status":"affected","version":"7c53f4238aa8bfb476e177263133ead2eeb8d55d","versionType":"git"},{"lessThan":"ee6e69d032550687a3422504bfca3f834c7b5061","status":"affected","version":"7c53f4238aa8bfb476e177263133ead2eeb8d55d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iommu/generic_pt/iommu_pt.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommupt: Fix short gather if the unmap goes into a large mapping\n\nunmap has the odd behavior that it can unmap more than requested if the\nending point lands within the middle of a large or contiguous IOPTE.\n\nIn this case the gather should flush everything unmapped which can be\nlarger than what was requested to be unmapped. The gather was only\nflushing the range requested to be unmapped, not extending to the extra\nrange, resulting in a short invalidation if the caller hits this special\ncondition.\n\nThis was found by the new invalidation/gather test I am adding in\npreparation for ARMv8. Claude deduced the root cause.\n\nAs far as I remember nothing relies on unmapping a large entry, so this is\nlikely not a triggerable bug."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommupt: Corrige la recolección corta si la desasignación entra en un mapeo grande\n\nLa desasignación tiene el comportamiento peculiar de que puede desasignar más de lo solicitado si el punto final cae dentro de la mitad de un IOPTE grande o contiguo.\n\nEn este caso, la recolección debería vaciar todo lo desasignado, lo cual puede ser mayor de lo que se solicitó desasignar. La recolección solo estaba vaciando el rango solicitado para desasignar, no extendiéndose al rango adicional, lo que resultaba en una invalidación corta si el llamador encuentra esta condición especial.\n\nEsto fue descubierto por la nueva prueba de invalidación/recolección que estoy añadiendo en preparación para ARMv8. Claude dedujo la causa raíz.\n\nPor lo que recuerdo, nada depende de la desasignación de una entrada grande, por lo que es probable que este no sea un error activable."}],"id":"CVE-2026-31735","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:36.140","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/50ecd96a28f712f8b682c0441f4cb9b086d28816"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee6e69d032550687a3422504bfca3f834c7b5061"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31736.json b/data/2026/CVE-2026-31736.json
index df94f4ee95..589c6121d4 100644
--- a/data/2026/CVE-2026-31736.json
+++ b/data/2026/CVE-2026-31736.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/mediatek/mtk_ppe_offload.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0b832aad33e6f160fda310f0306a6483d85e9d6e","status":"affected","version":"73cfd947dbdb25ef9863ac49c4596a7d53ad4025","versionType":"git"},{"lessThan":"5dff799c677152dde963c3917bacd9127b03e145","status":"affected","version":"73cfd947dbdb25ef9863ac49c4596a7d53ad4025","versionType":"git"},{"lessThan":"7b2380f0a0e374010c1a4a13203511b9dee5b166","status":"affected","version":"73cfd947dbdb25ef9863ac49c4596a7d53ad4025","versionType":"git"},{"lessThan":"976ff48c2ac6e6b25b01428c9d7997bcd0fb2949","status":"affected","version":"73cfd947dbdb25ef9863ac49c4596a7d53ad4025","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/mediatek/mtk_ppe_offload.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"41664AAE-F159-4875-BF5B-B86E659ADB8A","versionEndExcluding":"6.12.81","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled\n\nIf the gmac0 is disabled, the precheck for a valid ingress device will\ncause a NULL pointer deref and crash the system. This happens because\neth->netdev[0] will be NULL but the code will directly try to access\nnetdev_ops.\n\nInstead of just checking for the first net_device, it must be checked if\nany of the mtk_eth net_devices is matching the netdev_ops of the ingress\ndevice."}],"id":"CVE-2026-31736","lastModified":"2026-06-17T10:34:20.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.240","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b832aad33e6f160fda310f0306a6483d85e9d6e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5dff799c677152dde963c3917bacd9127b03e145"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b2380f0a0e374010c1a4a13203511b9dee5b166"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/976ff48c2ac6e6b25b01428c9d7997bcd0fb2949"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/mediatek/mtk_ppe_offload.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0b832aad33e6f160fda310f0306a6483d85e9d6e","status":"affected","version":"73cfd947dbdb25ef9863ac49c4596a7d53ad4025","versionType":"git"},{"lessThan":"5dff799c677152dde963c3917bacd9127b03e145","status":"affected","version":"73cfd947dbdb25ef9863ac49c4596a7d53ad4025","versionType":"git"},{"lessThan":"7b2380f0a0e374010c1a4a13203511b9dee5b166","status":"affected","version":"73cfd947dbdb25ef9863ac49c4596a7d53ad4025","versionType":"git"},{"lessThan":"976ff48c2ac6e6b25b01428c9d7997bcd0fb2949","status":"affected","version":"73cfd947dbdb25ef9863ac49c4596a7d53ad4025","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/mediatek/mtk_ppe_offload.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"41664AAE-F159-4875-BF5B-B86E659ADB8A","versionEndExcluding":"6.12.81","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled\n\nIf the gmac0 is disabled, the precheck for a valid ingress device will\ncause a NULL pointer deref and crash the system. This happens because\neth->netdev[0] will be NULL but the code will directly try to access\nnetdev_ops.\n\nInstead of just checking for the first net_device, it must be checked if\nany of the mtk_eth net_devices is matching the netdev_ops of the ingress\ndevice."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nnet: ethernet: mtk_ppe: evitar la desreferencia nula cuando gmac0 está deshabilitado\n\nSi gmac0 está deshabilitado, la verificación previa de un dispositivo de entrada válido causará una desreferencia de puntero NULL y bloqueará el sistema. Esto ocurre porque eth  ->  netdev[0] será NULL, pero el código intentará acceder directamente a netdev_ops.\n\nEn lugar de solo verificar el primer net_device, se debe comprobar si alguno de los net_devices de mtk_eth coincide con las netdev_ops del dispositivo de entrada."}],"id":"CVE-2026-31736","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.240","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b832aad33e6f160fda310f0306a6483d85e9d6e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5dff799c677152dde963c3917bacd9127b03e145"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b2380f0a0e374010c1a4a13203511b9dee5b166"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/976ff48c2ac6e6b25b01428c9d7997bcd0fb2949"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31737.json b/data/2026/CVE-2026-31737.json
index f6002f70de..066d5437f1 100644
--- a/data/2026/CVE-2026-31737.json
+++ b/data/2026/CVE-2026-31737.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/faraday/ftgmac100.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"184b3a500d60ea48d1b176103cff1706c456edf3","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"78da43320d9d6ed788147fb085184e4fc801f057","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"a7e1bf392acf11dc4209820fef75758f6e42bd65","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"8a71911fc7eeea930153322bc1efc065db8cd97e","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"d45230081f19c280096241353c26b0de457de795","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"8351d18989c8642fc53e2e12d94e42314a39b078","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"82f86111f0704ab2ded11a2033bc6cf0be3e09ea","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"c0fd0fe745f5e8c568d898cd1513d0083e46204a","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/faraday/ftgmac100.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7307BD3-C434-4557-91D2-ADE06A1D3C6F","versionEndExcluding":"5.10.253","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ftgmac100: fix ring allocation unwind on open failure\n\nftgmac100_alloc_rings() allocates rx_skbs, tx_skbs, rxdes, txdes, and\nrx_scratch in stages. On intermediate failures it returned -ENOMEM\ndirectly, leaking resources allocated earlier in the function.\n\nRework the failure path to use staged local unwind labels and free\nallocated resources in reverse order before returning -ENOMEM. This\nmatches common netdev allocation cleanup style."}],"id":"CVE-2026-31737","lastModified":"2026-11-10T13:19:04.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.347","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/184b3a500d60ea48d1b176103cff1706c456edf3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78da43320d9d6ed788147fb085184e4fc801f057"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82f86111f0704ab2ded11a2033bc6cf0be3e09ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8351d18989c8642fc53e2e12d94e42314a39b078"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a71911fc7eeea930153322bc1efc065db8cd97e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7e1bf392acf11dc4209820fef75758f6e42bd65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0fd0fe745f5e8c568d898cd1513d0083e46204a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d45230081f19c280096241353c26b0de457de795"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/faraday/ftgmac100.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"184b3a500d60ea48d1b176103cff1706c456edf3","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"78da43320d9d6ed788147fb085184e4fc801f057","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"a7e1bf392acf11dc4209820fef75758f6e42bd65","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"8a71911fc7eeea930153322bc1efc065db8cd97e","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"d45230081f19c280096241353c26b0de457de795","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"8351d18989c8642fc53e2e12d94e42314a39b078","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"82f86111f0704ab2ded11a2033bc6cf0be3e09ea","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"},{"lessThan":"c0fd0fe745f5e8c568d898cd1513d0083e46204a","status":"affected","version":"d72e01a0430f8a1ae7adb3cbf0b2e73fcd99252e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/faraday/ftgmac100.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7307BD3-C434-4557-91D2-ADE06A1D3C6F","versionEndExcluding":"5.10.253","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ftgmac100: fix ring allocation unwind on open failure\n\nftgmac100_alloc_rings() allocates rx_skbs, tx_skbs, rxdes, txdes, and\nrx_scratch in stages. On intermediate failures it returned -ENOMEM\ndirectly, leaking resources allocated earlier in the function.\n\nRework the failure path to use staged local unwind labels and free\nallocated resources in reverse order before returning -ENOMEM. This\nmatches common netdev allocation cleanup style."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: ftgmac100: corregir el deshacer de la asignación de anillos en caso de fallo de apertura\n\nftgmac100_alloc_rings() asigna rx_skbs, tx_skbs, rxdes, txdes y rx_scratch en etapas. En caso de fallos intermedios, devolvía -ENOMEM directamente, fugando recursos asignados anteriormente en la función.\n\nReestructurar la ruta de fallo para usar etiquetas de deshacer locales por etapas y liberar los recursos asignados en orden inverso antes de devolver -ENOMEM. Esto coincide con el estilo común de limpieza de asignación de netdev."}],"id":"CVE-2026-31737","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.347","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/184b3a500d60ea48d1b176103cff1706c456edf3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78da43320d9d6ed788147fb085184e4fc801f057"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82f86111f0704ab2ded11a2033bc6cf0be3e09ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8351d18989c8642fc53e2e12d94e42314a39b078"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a71911fc7eeea930153322bc1efc065db8cd97e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7e1bf392acf11dc4209820fef75758f6e42bd65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0fd0fe745f5e8c568d898cd1513d0083e46204a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d45230081f19c280096241353c26b0de457de795"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31738.json b/data/2026/CVE-2026-31738.json
index bc8c96c082..873a81c879 100644
--- a/data/2026/CVE-2026-31738.json
+++ b/data/2026/CVE-2026-31738.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"901c1dd3bab2955d7e664f914c374c8c3ac2b958","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"e476745917a1e288eb15e7ff49d286a86a4861d3","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"2029712fb2c87e9a8c75094906f2ee29bf08c500","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"602596c69a70e50d9ab8c6ae0290a01f88229dd7","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"de20d2e3b9179d132f5f5b44e490d7c916c6321b","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"eddfce70a6f3107d1679b0c2fcbeb96b593bd679","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"b69c4236255bd8de16cd876e58c6f0867d1d78b1","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"afa9a05e6c4971bd5586f1b304e14d61fb3d9385","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"status":"affected","version":"d8be18c52dbc94989f6d74637b731af39cd3d902","versionType":"git"},{"status":"affected","version":"3927dace523706cc00f808520eaf2125dd7c07b5","versionType":"git"},{"lessThan":"3.13","status":"affected","version":"3.12.18","versionType":"semver"},{"lessThan":"3.14","status":"affected","version":"3.13.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B3AB1AFE-C0A2-4331-AA17-444E45EF7B5A","versionEndExcluding":"3.13","versionStartIncluding":"3.12.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"32C97B50-DD9D-4C26-A3B5-3CB771644C8A","versionEndExcluding":"3.14","versionStartIncluding":"3.13.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96775134-B6E9-42CE-A367-9B4C33EFBF22","versionEndExcluding":"5.10.253","versionStartIncluding":"3.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.14:-:*:*:*:*:*:*","matchCriteriaId":"851B1505-0318-49F4-8D7C-196BE04FF173","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.14:rc8:*:*:*:*:*:*","matchCriteriaId":"055557BE-1FE9-45F5-8A95-F8D3C9B031E4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: validate ND option lengths in vxlan_na_create\n\nvxlan_na_create() walks ND options according to option-provided\nlengths. A malformed option can make the parser advance beyond the\ncomputed option span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address."}],"id":"CVE-2026-31738","lastModified":"2026-11-06T16:18:09.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31738","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:44.664769Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:36.473","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2029712fb2c87e9a8c75094906f2ee29bf08c500"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/602596c69a70e50d9ab8c6ae0290a01f88229dd7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/901c1dd3bab2955d7e664f914c374c8c3ac2b958"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/afa9a05e6c4971bd5586f1b304e14d61fb3d9385"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b69c4236255bd8de16cd876e58c6f0867d1d78b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de20d2e3b9179d132f5f5b44e490d7c916c6321b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e476745917a1e288eb15e7ff49d286a86a4861d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eddfce70a6f3107d1679b0c2fcbeb96b593bd679"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"901c1dd3bab2955d7e664f914c374c8c3ac2b958","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"e476745917a1e288eb15e7ff49d286a86a4861d3","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"2029712fb2c87e9a8c75094906f2ee29bf08c500","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"602596c69a70e50d9ab8c6ae0290a01f88229dd7","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"de20d2e3b9179d132f5f5b44e490d7c916c6321b","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"eddfce70a6f3107d1679b0c2fcbeb96b593bd679","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"b69c4236255bd8de16cd876e58c6f0867d1d78b1","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"lessThan":"afa9a05e6c4971bd5586f1b304e14d61fb3d9385","status":"affected","version":"4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa","versionType":"git"},{"status":"affected","version":"d8be18c52dbc94989f6d74637b731af39cd3d902","versionType":"git"},{"status":"affected","version":"3927dace523706cc00f808520eaf2125dd7c07b5","versionType":"git"},{"lessThan":"3.13","status":"affected","version":"3.12.18","versionType":"semver"},{"lessThan":"3.14","status":"affected","version":"3.13.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/vxlan/vxlan_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B3AB1AFE-C0A2-4331-AA17-444E45EF7B5A","versionEndExcluding":"3.13","versionStartIncluding":"3.12.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"32C97B50-DD9D-4C26-A3B5-3CB771644C8A","versionEndExcluding":"3.14","versionStartIncluding":"3.13.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96775134-B6E9-42CE-A367-9B4C33EFBF22","versionEndExcluding":"5.10.253","versionStartIncluding":"3.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.14:-:*:*:*:*:*:*","matchCriteriaId":"851B1505-0318-49F4-8D7C-196BE04FF173","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.14:rc8:*:*:*:*:*:*","matchCriteriaId":"055557BE-1FE9-45F5-8A95-F8D3C9B031E4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: validate ND option lengths in vxlan_na_create\n\nvxlan_na_create() walks ND options according to option-provided\nlengths. A malformed option can make the parser advance beyond the\ncomputed option span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvxlan: validar las longitudes de opción ND en vxlan_na_create\n\nvxlan_na_create() recorre las opciones ND según las longitudes proporcionadas por la opción. Una opción malformada puede hacer que el analizador avance más allá del alcance de opción calculado o utilice una carga útil de opción LLADDR de origen demasiado corta.\n\nValidar las longitudes de opción contra el área de opción NS restante antes de avanzar, y solo leer LLADDR de origen cuando la opción sea lo suficientemente grande para una dirección Ethernet."}],"id":"CVE-2026-31738","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31738","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:44.664769Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:36.473","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2029712fb2c87e9a8c75094906f2ee29bf08c500"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/602596c69a70e50d9ab8c6ae0290a01f88229dd7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/901c1dd3bab2955d7e664f914c374c8c3ac2b958"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/afa9a05e6c4971bd5586f1b304e14d61fb3d9385"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b69c4236255bd8de16cd876e58c6f0867d1d78b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de20d2e3b9179d132f5f5b44e490d7c916c6321b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e476745917a1e288eb15e7ff49d286a86a4861d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eddfce70a6f3107d1679b0c2fcbeb96b593bd679"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31739.json b/data/2026/CVE-2026-31739.json
index 631c6baf7c..6e512ea193 100644
--- a/data/2026/CVE-2026-31739.json
+++ b/data/2026/CVE-2026-31739.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/tegra/tegra-se-aes.c","drivers/crypto/tegra/tegra-se-hash.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bdbf027a4504b4a86740de6beb6d18a957331839","status":"affected","version":"0880bb3b00c855fc244b7177ffdaafef4d0aa1e0","versionType":"git"},{"lessThan":"3aea268b6d5cde3b087df9eeecc3bc620aa09513","status":"affected","version":"0880bb3b00c855fc244b7177ffdaafef4d0aa1e0","versionType":"git"},{"lessThan":"429d05565eb19ee545d8a8395991372adbe4daf3","status":"affected","version":"0880bb3b00c855fc244b7177ffdaafef4d0aa1e0","versionType":"git"},{"lessThan":"4b56770d345524fc2acc143a2b85539cf7d74bc1","status":"affected","version":"0880bb3b00c855fc244b7177ffdaafef4d0aa1e0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/tegra/tegra-se-aes.c","drivers/crypto/tegra/tegra-se-hash.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"152F22C9-12F1-4E51-A98B-BC5F10DD76FD","versionEndExcluding":"6.12.81","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - Add missing CRYPTO_ALG_ASYNC\n\nThe tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its\nasynchronous algorithms, causing the crypto API to select them for users\nthat request only synchronous algorithms.  This causes crashes (at\nleast).  Fix this by adding the flag like what the other drivers do.\nAlso remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just\nget ignored and overridden by the registration function anyway."}],"id":"CVE-2026-31739","lastModified":"2026-10-19T20:17:57.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:55.319558Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:36.600","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3aea268b6d5cde3b087df9eeecc3bc620aa09513"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/429d05565eb19ee545d8a8395991372adbe4daf3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b56770d345524fc2acc143a2b85539cf7d74bc1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bdbf027a4504b4a86740de6beb6d18a957331839"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/crypto/tegra/tegra-se-aes.c","drivers/crypto/tegra/tegra-se-hash.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bdbf027a4504b4a86740de6beb6d18a957331839","status":"affected","version":"0880bb3b00c855fc244b7177ffdaafef4d0aa1e0","versionType":"git"},{"lessThan":"3aea268b6d5cde3b087df9eeecc3bc620aa09513","status":"affected","version":"0880bb3b00c855fc244b7177ffdaafef4d0aa1e0","versionType":"git"},{"lessThan":"429d05565eb19ee545d8a8395991372adbe4daf3","status":"affected","version":"0880bb3b00c855fc244b7177ffdaafef4d0aa1e0","versionType":"git"},{"lessThan":"4b56770d345524fc2acc143a2b85539cf7d74bc1","status":"affected","version":"0880bb3b00c855fc244b7177ffdaafef4d0aa1e0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/crypto/tegra/tegra-se-aes.c","drivers/crypto/tegra/tegra-se-hash.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"152F22C9-12F1-4E51-A98B-BC5F10DD76FD","versionEndExcluding":"6.12.81","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: tegra - Add missing CRYPTO_ALG_ASYNC\n\nThe tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its\nasynchronous algorithms, causing the crypto API to select them for users\nthat request only synchronous algorithms.  This causes crashes (at\nleast).  Fix this by adding the flag like what the other drivers do.\nAlso remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just\nget ignored and overridden by the registration function anyway."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ncrypto: tegra - Añadir CRYPTO_ALG_ASYNC faltante\n\nEl controlador criptográfico tegra no pudo establecer el CRYPTO_ALG_ASYNC en sus algoritmos asíncronos, provocando que la API criptográfica los seleccionara para usuarios que solicitan solo algoritmos síncronos. Esto provoca fallos (al menos). Corrige esto añadiendo el indicador como hacen los otros controladores. También elimina los indicadores CRYPTO_ALG_TYPE_* innecesarios, ya que esos simplemente son ignorados y sobrescritos por la función de registro de todos modos."}],"id":"CVE-2026-31739","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:55.319558Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:36.600","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3aea268b6d5cde3b087df9eeecc3bc620aa09513"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/429d05565eb19ee545d8a8395991372adbe4daf3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b56770d345524fc2acc143a2b85539cf7d74bc1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bdbf027a4504b4a86740de6beb6d18a957331839"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31740.json b/data/2026/CVE-2026-31740.json
index 3da232aa3f..adad59bd16 100644
--- a/data/2026/CVE-2026-31740.json
+++ b/data/2026/CVE-2026-31740.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/counter/rz-mtu3-cnt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"28a371be901ef44ee03726c2575d7d6795521fe0","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"633dfbf0eb2766c597c1a59dd83035c82e14791d","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"6562290225c197e2e193a53de2a517815288dcd1","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"63be324c795262f0e316c6fe9b329d83afa1ec93","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"2932095c114b98cbb40ccf34fc00d613cb17cead","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/counter/rz-mtu3-cnt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1AFB41D-EE40-4D1A-93ED-E8655E9E65C4","versionEndExcluding":"6.6.134","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncounter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member\n\nThe counter driver can use HW channels 1 and 2, while the PWM driver can\nuse HW channels 0, 1, 2, 3, 4, 6, 7.\n\nThe dev member is assigned both by the counter driver and the PWM driver\nfor channels 1 and 2, to their own struct device instance, overwriting\nthe previous value.\n\nThe sub-drivers race to assign their own struct device pointer to the\nsame struct rz_mtu3_channel's dev member.\n\nThe dev member of struct rz_mtu3_channel is used by the counter\nsub-driver for runtime PM.\n\nDepending on the probe order of the counter and PWM sub-drivers, the\ndev member may point to the wrong struct device instance, causing the\ncounter sub-driver to do runtime PM actions on the wrong device.\n\nTo fix this, use the parent pointer of the counter, which is assigned\nduring probe to the correct struct device, not the struct device pointer\ninside the shared struct rz_mtu3_channel."}],"id":"CVE-2026-31740","lastModified":"2026-06-17T10:34:22.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.710","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28a371be901ef44ee03726c2575d7d6795521fe0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2932095c114b98cbb40ccf34fc00d613cb17cead"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/633dfbf0eb2766c597c1a59dd83035c82e14791d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63be324c795262f0e316c6fe9b329d83afa1ec93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6562290225c197e2e193a53de2a517815288dcd1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/counter/rz-mtu3-cnt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"28a371be901ef44ee03726c2575d7d6795521fe0","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"633dfbf0eb2766c597c1a59dd83035c82e14791d","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"6562290225c197e2e193a53de2a517815288dcd1","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"63be324c795262f0e316c6fe9b329d83afa1ec93","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"2932095c114b98cbb40ccf34fc00d613cb17cead","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/counter/rz-mtu3-cnt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1AFB41D-EE40-4D1A-93ED-E8655E9E65C4","versionEndExcluding":"6.6.134","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncounter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member\n\nThe counter driver can use HW channels 1 and 2, while the PWM driver can\nuse HW channels 0, 1, 2, 3, 4, 6, 7.\n\nThe dev member is assigned both by the counter driver and the PWM driver\nfor channels 1 and 2, to their own struct device instance, overwriting\nthe previous value.\n\nThe sub-drivers race to assign their own struct device pointer to the\nsame struct rz_mtu3_channel's dev member.\n\nThe dev member of struct rz_mtu3_channel is used by the counter\nsub-driver for runtime PM.\n\nDepending on the probe order of the counter and PWM sub-drivers, the\ndev member may point to the wrong struct device instance, causing the\ncounter sub-driver to do runtime PM actions on the wrong device.\n\nTo fix this, use the parent pointer of the counter, which is assigned\nduring probe to the correct struct device, not the struct device pointer\ninside the shared struct rz_mtu3_channel."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncontador: rz-mtu3-cnt: no usar el miembro dev de struct rz_mtu3_channel\n\nEl controlador de contador puede usar los canales HW 1 y 2, mientras que el controlador PWM puede usar los canales HW 0, 1, 2, 3, 4, 6, 7.\n\nEl miembro dev es asignado tanto por el controlador de contador como por el controlador PWM para los canales 1 y 2, a su propia instancia de struct device, sobrescribiendo el valor anterior.\n\nLos subcontroladores compiten por asignar su propio puntero a struct device al mismo miembro dev de struct rz_mtu3_channel.\n\nEl miembro dev de struct rz_mtu3_channel es usado por el subcontrolador de contador para PM en tiempo de ejecución.\n\nDependiendo del orden de sondeo de los subcontroladores de contador y PWM, el miembro dev puede apuntar a la instancia incorrecta de struct device, haciendo que el subcontrolador de contador realice acciones de PM en tiempo de ejecución en el dispositivo incorrecto.\n\nPara solucionar esto, usar el puntero padre del contador, el cual es asignado durante el sondeo a la struct device correcta, no el puntero a struct device dentro de la struct rz_mtu3_channel compartida."}],"id":"CVE-2026-31740","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.710","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28a371be901ef44ee03726c2575d7d6795521fe0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2932095c114b98cbb40ccf34fc00d613cb17cead"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/633dfbf0eb2766c597c1a59dd83035c82e14791d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63be324c795262f0e316c6fe9b329d83afa1ec93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6562290225c197e2e193a53de2a517815288dcd1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31741.json b/data/2026/CVE-2026-31741.json
index ffb6c51f40..2cd39a4f0e 100644
--- a/data/2026/CVE-2026-31741.json
+++ b/data/2026/CVE-2026-31741.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/counter/rz-mtu3-cnt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"885aa739a07ab45e90dfa997205acec97979ce4e","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"ced8b48420eddb1251f93c22dc23fa136490b3cd","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"e07237df8538b0ae98dce112e4f6db093d767f80","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"f5f6f06d7e6d262026578b59ba7426eb04acce5d","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"67c3f99bed6f422ba343d2b70a2eeeccdfd91bef","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/counter/rz-mtu3-cnt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1AFB41D-EE40-4D1A-93ED-E8655E9E65C4","versionEndExcluding":"6.6.134","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncounter: rz-mtu3-cnt: prevent counter from being toggled multiple times\n\nRuntime PM counter is incremented / decremented each time the sysfs\nenable file is written to.\n\nIf user writes 0 to the sysfs enable file multiple times, runtime PM\nusage count underflows, generating the following message.\n\nrz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!\n\nAt the same time, hardware registers end up being accessed with clocks\noff in rz_mtu3_terminate_counter() to disable an already disabled\nchannel.\n\nIf user writes 1 to the sysfs enable file multiple times, runtime PM\nusage count will be incremented each time, requiring the same number of\n0 writes to get it back to 0.\n\nIf user writes 0 to the sysfs enable file while PWM is in progress, PWM\nis stopped without counter being the owner of the underlying MTU3\nchannel.\n\nCheck against the cached count_is_enabled value and exit if the user\nis trying to set the same enable value."}],"id":"CVE-2026-31741","lastModified":"2026-06-17T10:34:22.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.820","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67c3f99bed6f422ba343d2b70a2eeeccdfd91bef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/885aa739a07ab45e90dfa997205acec97979ce4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ced8b48420eddb1251f93c22dc23fa136490b3cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e07237df8538b0ae98dce112e4f6db093d767f80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f5f6f06d7e6d262026578b59ba7426eb04acce5d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/counter/rz-mtu3-cnt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"885aa739a07ab45e90dfa997205acec97979ce4e","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"ced8b48420eddb1251f93c22dc23fa136490b3cd","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"e07237df8538b0ae98dce112e4f6db093d767f80","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"f5f6f06d7e6d262026578b59ba7426eb04acce5d","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"},{"lessThan":"67c3f99bed6f422ba343d2b70a2eeeccdfd91bef","status":"affected","version":"0be8907359df4c62319f5cb2c6981ff0d9ebf35a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/counter/rz-mtu3-cnt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1AFB41D-EE40-4D1A-93ED-E8655E9E65C4","versionEndExcluding":"6.6.134","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncounter: rz-mtu3-cnt: prevent counter from being toggled multiple times\n\nRuntime PM counter is incremented / decremented each time the sysfs\nenable file is written to.\n\nIf user writes 0 to the sysfs enable file multiple times, runtime PM\nusage count underflows, generating the following message.\n\nrz-mtu3-counter rz-mtu3-counter.0: Runtime PM usage count underflow!\n\nAt the same time, hardware registers end up being accessed with clocks\noff in rz_mtu3_terminate_counter() to disable an already disabled\nchannel.\n\nIf user writes 1 to the sysfs enable file multiple times, runtime PM\nusage count will be incremented each time, requiring the same number of\n0 writes to get it back to 0.\n\nIf user writes 0 to the sysfs enable file while PWM is in progress, PWM\nis stopped without counter being the owner of the underlying MTU3\nchannel.\n\nCheck against the cached count_is_enabled value and exit if the user\nis trying to set the same enable value."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncounter: rz-mtu3-cnt: evitar que el contador sea conmutado múltiples veces\n\nEl contador de PM en tiempo de ejecución se incrementa / decrementa cada vez que se escribe en el archivo de habilitación de sysfs.\n\nSi el usuario escribe 0 en el archivo de habilitación de sysfs varias veces, el recuento de uso de PM en tiempo de ejecución sufre un subdesbordamiento, generando el siguiente mensaje.\n\nrz-mtu3-counter rz-mtu3-counter.0: ¡Subdesbordamiento del recuento de uso de PM en tiempo de ejecución!\n\nAl mismo tiempo, los registros de hardware terminan siendo accedidos con los relojes apagados en rz_mtu3_terminate_counter() para deshabilitar un canal ya deshabilitado.\n\nSi el usuario escribe 1 en el archivo de habilitación de sysfs varias veces, el recuento de uso de PM en tiempo de ejecución se incrementará cada vez, requiriendo el mismo número de escrituras de 0 para devolverlo a 0.\n\nSi el usuario escribe 0 en el archivo de habilitación de sysfs mientras PWM está en curso, PWM se detiene sin que el contador sea el propietario del canal MTU3 subyacente.\n\nVerificar contra el valor almacenado en caché de count_is_enabled y salir si el usuario está intentando establecer el mismo valor de habilitación."}],"id":"CVE-2026-31741","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:36.820","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67c3f99bed6f422ba343d2b70a2eeeccdfd91bef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/885aa739a07ab45e90dfa997205acec97979ce4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ced8b48420eddb1251f93c22dc23fa136490b3cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e07237df8538b0ae98dce112e4f6db093d767f80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f5f6f06d7e6d262026578b59ba7426eb04acce5d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31742.json b/data/2026/CVE-2026-31742.json
index 8df9429590..1b0d1b2cbd 100644
--- a/data/2026/CVE-2026-31742.json
+++ b/data/2026/CVE-2026-31742.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/vt/vt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"891d790fdb5c96c6e1d2841e06ee6c360f2d1288","status":"affected","version":"c4efef65a46f610418a3f69149c51492d31c8591","versionType":"git"},{"lessThan":"428fdf55301e6c8fa5a36b426240797b1cf86570","status":"affected","version":"1cf66bd9127447c57295f5199029e8d8b47c6c67","versionType":"git"},{"lessThan":"40014493cece72a0be5672cd86763e53fb3ec613","status":"affected","version":"5eb608319bb56464674a71b4a66ea65c6c435d64","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/vt/vt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.22","status":"affected","version":"6.18.20","versionType":"semver"},{"lessThan":"6.19.12","status":"affected","version":"6.19.10","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7B6CD870-DF92-432B-A966-F190AE04E97F","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6BF1D424-BCB7-4168-AFD4-DE335B44DACF","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvt: discard stale unicode buffer on alt screen exit after resize\n\nWhen enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and\nsets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize()\nskips reallocating the unicode buffer because vc_uni_lines is NULL.\nHowever, vc_saved_uni_lines still points to the old buffer allocated for\nthe original dimensions.\n\nWhen leave_alt_screen() later restores vc_saved_uni_lines, the buffer\ndimensions no longer match vc_rows/vc_cols. Any operation that iterates\nover the unicode buffer using the current dimensions (e.g. csi_J clearing\nthe screen) will access memory out of bounds, causing a kernel oops:\n\n  BUG: unable to handle page fault for address: 0x0000002000000020\n  RIP: 0010:csi_J+0x133/0x2d0\n\nThe faulting address 0x0000002000000020 is two adjacent u32 space\ncharacters (0x20) interpreted as a pointer, read from the row data area\npast the end of the 25-entry pointer array in a buffer allocated for\n80x25 but accessed with 240x67 dimensions.\n\nFix this by checking whether the console dimensions changed while in the\nalternate screen. If they did, free the stale saved buffer instead of\nrestoring it. The unicode screen will be lazily rebuilt via\nvc_uniscr_check() when next needed."}],"id":"CVE-2026-31742","lastModified":"2026-10-19T20:17:57.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31742","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:57.933644Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:36.937","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40014493cece72a0be5672cd86763e53fb3ec613"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/428fdf55301e6c8fa5a36b426240797b1cf86570"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/891d790fdb5c96c6e1d2841e06ee6c360f2d1288"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/vt/vt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"891d790fdb5c96c6e1d2841e06ee6c360f2d1288","status":"affected","version":"c4efef65a46f610418a3f69149c51492d31c8591","versionType":"git"},{"lessThan":"428fdf55301e6c8fa5a36b426240797b1cf86570","status":"affected","version":"1cf66bd9127447c57295f5199029e8d8b47c6c67","versionType":"git"},{"lessThan":"40014493cece72a0be5672cd86763e53fb3ec613","status":"affected","version":"5eb608319bb56464674a71b4a66ea65c6c435d64","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/vt/vt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.22","status":"affected","version":"6.18.20","versionType":"semver"},{"lessThan":"6.19.12","status":"affected","version":"6.19.10","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7B6CD870-DF92-432B-A966-F190AE04E97F","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6BF1D424-BCB7-4168-AFD4-DE335B44DACF","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvt: discard stale unicode buffer on alt screen exit after resize\n\nWhen enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and\nsets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize()\nskips reallocating the unicode buffer because vc_uni_lines is NULL.\nHowever, vc_saved_uni_lines still points to the old buffer allocated for\nthe original dimensions.\n\nWhen leave_alt_screen() later restores vc_saved_uni_lines, the buffer\ndimensions no longer match vc_rows/vc_cols. Any operation that iterates\nover the unicode buffer using the current dimensions (e.g. csi_J clearing\nthe screen) will access memory out of bounds, causing a kernel oops:\n\n  BUG: unable to handle page fault for address: 0x0000002000000020\n  RIP: 0010:csi_J+0x133/0x2d0\n\nThe faulting address 0x0000002000000020 is two adjacent u32 space\ncharacters (0x20) interpreted as a pointer, read from the row data area\npast the end of the 25-entry pointer array in a buffer allocated for\n80x25 but accessed with 240x67 dimensions.\n\nFix this by checking whether the console dimensions changed while in the\nalternate screen. If they did, free the stale saved buffer instead of\nrestoring it. The unicode screen will be lazily rebuilt via\nvc_uniscr_check() when next needed."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvt: descartar búfer Unicode obsoleto al salir de la pantalla alternativa después de un redimensionamiento\n\nCuando enter_alt_screen() guarda vc_uni_lines en vc_saved_uni_lines y establece vc_uni_lines en NULL, un redimensionamiento posterior de la consola a través de vc_do_resize() omite la reasignación del búfer Unicode porque vc_uni_lines es NULL. Sin embargo, vc_saved_uni_lines todavía apunta al búfer antiguo asignado para las dimensiones originales.\n\nCuando leave_alt_screen() más tarde restaura vc_saved_uni_lines, las dimensiones del búfer ya no coinciden con vc_rows/vc_cols. Cualquier operación que itere sobre el búfer Unicode utilizando las dimensiones actuales (por ejemplo, csi_J borrando la pantalla) accederá a memoria fuera de los límites, causando un kernel oops:\n\n  BUG: no se puede manejar el fallo de página para la dirección: 0x 0000002000000020\n  RIP: 0010:csi_J+0x133/0x2d0\n\nLa dirección de fallo 0x 0000002000000020 son dos caracteres de espacio u32 adyacentes (0x20) interpretados como un puntero, leídos del área de datos de fila más allá del final del array de punteros de 25 entradas en un búfer asignado para 80x25 pero accedido con dimensiones de 240x67.\n\nSolucione esto comprobando si las dimensiones de la consola cambiaron mientras estaba en la pantalla alternativa. Si lo hicieron, libere el búfer guardado obsoleto en lugar de restaurarlo. La pantalla Unicode se reconstruirá de forma perezosa a través de vc_uniscr_check() cuando sea necesario de nuevo."}],"id":"CVE-2026-31742","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31742","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:57.933644Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:36.937","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40014493cece72a0be5672cd86763e53fb3ec613"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/428fdf55301e6c8fa5a36b426240797b1cf86570"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/891d790fdb5c96c6e1d2841e06ee6c360f2d1288"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31743.json b/data/2026/CVE-2026-31743.json
index 82effa189d..041bd50939 100644
--- a/data/2026/CVE-2026-31743.json
+++ b/data/2026/CVE-2026-31743.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvmem/zynqmp_nvmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2f6e5b9964d0a63a5ba84fca2642876afb70a662","status":"affected","version":"737c0c8d07b5f671c0a33cec95965fcb2d2ea893","versionType":"git"},{"lessThan":"784ed4abded1ca4b525fa4cade8b02f8c5d2a087","status":"affected","version":"737c0c8d07b5f671c0a33cec95965fcb2d2ea893","versionType":"git"},{"lessThan":"6c01e7f11f5e5f22285d19510a9643e2506e13c3","status":"affected","version":"737c0c8d07b5f671c0a33cec95965fcb2d2ea893","versionType":"git"},{"lessThan":"f9b88613ff402aa6fe8fd020573cb95867ae947e","status":"affected","version":"737c0c8d07b5f671c0a33cec95965fcb2d2ea893","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvmem/zynqmp_nvmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6276F46A-4462-4160-9890-B059A6D60C74","versionEndExcluding":"6.12.81","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy\n\nBuffer size used in dma allocation and memcpy is wrong.\nIt can lead to undersized DMA buffer access and possible\nmemory corruption. use correct buffer size in dma_alloc_coherent\nand memcpy."}],"id":"CVE-2026-31743","lastModified":"2026-06-17T10:34:22.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:37.047","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f6e5b9964d0a63a5ba84fca2642876afb70a662"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c01e7f11f5e5f22285d19510a9643e2506e13c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/784ed4abded1ca4b525fa4cade8b02f8c5d2a087"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9b88613ff402aa6fe8fd020573cb95867ae947e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvmem/zynqmp_nvmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2f6e5b9964d0a63a5ba84fca2642876afb70a662","status":"affected","version":"737c0c8d07b5f671c0a33cec95965fcb2d2ea893","versionType":"git"},{"lessThan":"784ed4abded1ca4b525fa4cade8b02f8c5d2a087","status":"affected","version":"737c0c8d07b5f671c0a33cec95965fcb2d2ea893","versionType":"git"},{"lessThan":"6c01e7f11f5e5f22285d19510a9643e2506e13c3","status":"affected","version":"737c0c8d07b5f671c0a33cec95965fcb2d2ea893","versionType":"git"},{"lessThan":"f9b88613ff402aa6fe8fd020573cb95867ae947e","status":"affected","version":"737c0c8d07b5f671c0a33cec95965fcb2d2ea893","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvmem/zynqmp_nvmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6276F46A-4462-4160-9890-B059A6D60C74","versionEndExcluding":"6.12.81","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy\n\nBuffer size used in dma allocation and memcpy is wrong.\nIt can lead to undersized DMA buffer access and possible\nmemory corruption. use correct buffer size in dma_alloc_coherent\nand memcpy."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvmem: zynqmp_nvmem: Corrección del tamaño del búfer en DMA y memcpy\n\nEl tamaño del búfer utilizado en la asignación de DMA y memcpy es incorrecto.\nEsto puede llevar a un acceso a búferes DMA de tamaño insuficiente y a una posible corrupción de memoria. Utilizar el tamaño de búfer correcto en dma_alloc_coherent y memcpy."}],"id":"CVE-2026-31743","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:37.047","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f6e5b9964d0a63a5ba84fca2642876afb70a662"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c01e7f11f5e5f22285d19510a9643e2506e13c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/784ed4abded1ca4b525fa4cade8b02f8c5d2a087"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9b88613ff402aa6fe8fd020573cb95867ae947e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31744.json b/data/2026/CVE-2026-31744.json
index 72e50b9da1..65a6d56465 100644
--- a/data/2026/CVE-2026-31744.json
+++ b/data/2026/CVE-2026-31744.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/power/em_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ab09b9a1e3b02ff62c5aebe3b12b0cb4cb4ea8ab","status":"affected","version":"380ff27af25e49e2cb2ff8fd0ecd7c95be2976ee","versionType":"git"},{"lessThan":"9badc2a84e688be1275bb740942d5f6f51746908","status":"affected","version":"380ff27af25e49e2cb2ff8fd0ecd7c95be2976ee","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/power/em_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6A3292BD-59D7-4901-9701-EF89FB933C8E","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*","matchCriteriaId":"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*","matchCriteriaId":"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*","matchCriteriaId":"EB5B7DFC-C36B-45D8-922C-877569FDDF43","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPM: EM: Fix NULL pointer dereference when perf domain ID is not found\n\ndev_energymodel_nl_get_perf_domains_doit() calls\nem_perf_domain_get_by_id() but does not check the return value before\npassing it to __em_nl_get_pd_size(). When a caller supplies a\nnon-existent perf domain ID, em_perf_domain_get_by_id() returns NULL,\nand __em_nl_get_pd_size() immediately dereferences pd->cpus\n(struct offset 0x30), causing a NULL pointer dereference.\n\nThe sister handler dev_energymodel_nl_get_perf_table_doit() already\nhandles this correctly via __em_nl_get_pd_table_id(), which returns\nNULL and causes the caller to return -EINVAL. Add the same NULL check\nin the get-perf-domains do handler.\n\n[ rjw: Subject and changelog edits ]"}],"id":"CVE-2026-31744","lastModified":"2026-06-17T10:34:22.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.157","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9badc2a84e688be1275bb740942d5f6f51746908"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab09b9a1e3b02ff62c5aebe3b12b0cb4cb4ea8ab"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/power/em_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ab09b9a1e3b02ff62c5aebe3b12b0cb4cb4ea8ab","status":"affected","version":"380ff27af25e49e2cb2ff8fd0ecd7c95be2976ee","versionType":"git"},{"lessThan":"9badc2a84e688be1275bb740942d5f6f51746908","status":"affected","version":"380ff27af25e49e2cb2ff8fd0ecd7c95be2976ee","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/power/em_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6A3292BD-59D7-4901-9701-EF89FB933C8E","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*","matchCriteriaId":"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*","matchCriteriaId":"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*","matchCriteriaId":"EB5B7DFC-C36B-45D8-922C-877569FDDF43","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPM: EM: Fix NULL pointer dereference when perf domain ID is not found\n\ndev_energymodel_nl_get_perf_domains_doit() calls\nem_perf_domain_get_by_id() but does not check the return value before\npassing it to __em_nl_get_pd_size(). When a caller supplies a\nnon-existent perf domain ID, em_perf_domain_get_by_id() returns NULL,\nand __em_nl_get_pd_size() immediately dereferences pd->cpus\n(struct offset 0x30), causing a NULL pointer dereference.\n\nThe sister handler dev_energymodel_nl_get_perf_table_doit() already\nhandles this correctly via __em_nl_get_pd_table_id(), which returns\nNULL and causes the caller to return -EINVAL. Add the same NULL check\nin the get-perf-domains do handler.\n\n[ rjw: Subject and changelog edits ]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPM: EM: Corrección de desreferencia de puntero NULL cuando no se encuentra el ID de dominio de rendimiento\n\ndev_energymodel_nl_get_perf_domains_doit() llama a\nem_perf_domain_get_by_id() pero no comprueba el valor de retorno antes\nde pasarlo a __em_nl_get_pd_size(). Cuando un llamador proporciona un\nID de dominio de rendimiento inexistente, em_perf_domain_get_by_id() devuelve NULL,\ny __em_nl_get_pd_size() desreferencia inmediatamente pd  ->  cpus\n(desplazamiento de estructura 0x30), causando una desreferencia de puntero NULL.\n\nEl gestor hermano dev_energymodel_nl_get_perf_table_doit() ya\nmaneja esto correctamente a través de __em_nl_get_pd_table_id(), que devuelve\nNULL y hace que el llamador devuelva -EINVAL. Añadir la misma comprobación de NULL\nen el gestor ’do’ de get-perf-domains.\n\n[ rjw: Ediciones de asunto y registro de cambios ]"}],"id":"CVE-2026-31744","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.157","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9badc2a84e688be1275bb740942d5f6f51746908"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab09b9a1e3b02ff62c5aebe3b12b0cb4cb4ea8ab"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31745.json b/data/2026/CVE-2026-31745.json
index 3255a614bd..d8c32a3b32 100644
--- a/data/2026/CVE-2026-31745.json
+++ b/data/2026/CVE-2026-31745.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/reset/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1de465753220deb41569cf2add87bbb0673731db","status":"affected","version":"5fc4e4cf7a2268b5f73700fd1e8d02159f2417d8","versionType":"git"},{"lessThan":"fbffb8c7c7bb4d38e9f65e0bee446685011de5d8","status":"affected","version":"5fc4e4cf7a2268b5f73700fd1e8d02159f2417d8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/reset/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nreset: gpio: fix double free in reset_add_gpio_aux_device() error path\n\nWhen __auxiliary_device_add() fails, reset_add_gpio_aux_device()\ncalls auxiliary_device_uninit(adev).\n\nThe device release callback reset_gpio_aux_device_release() frees\nadev, but the current error path then calls kfree(adev) again,\ncausing a double free.\n\nKeep kfree(adev) for the auxiliary_device_init() failure path, but\navoid freeing adev after auxiliary_device_uninit()."}],"id":"CVE-2026-31745","lastModified":"2026-06-17T10:34:23.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.260","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1de465753220deb41569cf2add87bbb0673731db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbffb8c7c7bb4d38e9f65e0bee446685011de5d8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/reset/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1de465753220deb41569cf2add87bbb0673731db","status":"affected","version":"5fc4e4cf7a2268b5f73700fd1e8d02159f2417d8","versionType":"git"},{"lessThan":"fbffb8c7c7bb4d38e9f65e0bee446685011de5d8","status":"affected","version":"5fc4e4cf7a2268b5f73700fd1e8d02159f2417d8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/reset/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nreset: gpio: fix double free in reset_add_gpio_aux_device() error path\n\nWhen __auxiliary_device_add() fails, reset_add_gpio_aux_device()\ncalls auxiliary_device_uninit(adev).\n\nThe device release callback reset_gpio_aux_device_release() frees\nadev, but the current error path then calls kfree(adev) again,\ncausing a double free.\n\nKeep kfree(adev) for the auxiliary_device_init() failure path, but\navoid freeing adev after auxiliary_device_uninit()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nreset: gpio: corregir doble liberación en la ruta de error de reset_add_gpio_aux_device()\n\nCuando __auxiliary_device_add() falla, reset_add_gpio_aux_device() llama a auxiliary_device_uninit(adev).\n\nLa función de devolución de llamada de liberación del dispositivo reset_gpio_aux_device_release() libera adev, pero la ruta de error actual luego llama a kfree(adev) de nuevo, causando una doble liberación.\n\nMantener kfree(adev) para la ruta de fallo de auxiliary_device_init(), pero evitar liberar adev después de auxiliary_device_uninit()."}],"id":"CVE-2026-31745","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.260","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1de465753220deb41569cf2add87bbb0673731db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbffb8c7c7bb4d38e9f65e0bee446685011de5d8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31746.json b/data/2026/CVE-2026-31746.json
index 7c4a82b0cc..7b4c97f098 100644
--- a/data/2026/CVE-2026-31746.json
+++ b/data/2026/CVE-2026-31746.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/s390/crypto/zcrypt_msgtype6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1650268579e1113b30402dbcca4dba6589a0fccf","status":"affected","version":"919b3885c293057061af32dfeb0e20bba4f7a378","versionType":"git"},{"lessThan":"586222c37d4027dbf60a604fbe820184fee7c1c9","status":"affected","version":"57db62a130ce69e6f3a870cf1119d8f860391f97","versionType":"git"},{"lessThan":"ace37bfec3822033e59fff390f2ff99fc96ebe4f","status":"affected","version":"57db62a130ce69e6f3a870cf1119d8f860391f97","versionType":"git"},{"lessThan":"c8d46f17c2fc7d25c18e60c008928aecab26184d","status":"affected","version":"57db62a130ce69e6f3a870cf1119d8f860391f97","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/s390/crypto/zcrypt_msgtype6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B376ADEA-99DD-4C34-B0B2-7362FBE63A29","versionEndExcluding":"6.18.22","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix memory leak with CCA cards used as accelerator\n\nTests showed that there is a memory leak if CCA cards are used as\naccelerator for clear key RSA requests (ME and CRT). With the last\nrework for the memory allocation the AP messages are allocated by\nap_init_apmsg() but for some reason on two places (ME and CRT) the\nolder allocation was still in place. So the first allocation simple\nwas never freed."}],"id":"CVE-2026-31746","lastModified":"2026-10-21T13:18:42.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.363","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1650268579e1113b30402dbcca4dba6589a0fccf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/586222c37d4027dbf60a604fbe820184fee7c1c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ace37bfec3822033e59fff390f2ff99fc96ebe4f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8d46f17c2fc7d25c18e60c008928aecab26184d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/s390/crypto/zcrypt_msgtype6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1650268579e1113b30402dbcca4dba6589a0fccf","status":"affected","version":"919b3885c293057061af32dfeb0e20bba4f7a378","versionType":"git"},{"lessThan":"586222c37d4027dbf60a604fbe820184fee7c1c9","status":"affected","version":"57db62a130ce69e6f3a870cf1119d8f860391f97","versionType":"git"},{"lessThan":"ace37bfec3822033e59fff390f2ff99fc96ebe4f","status":"affected","version":"57db62a130ce69e6f3a870cf1119d8f860391f97","versionType":"git"},{"lessThan":"c8d46f17c2fc7d25c18e60c008928aecab26184d","status":"affected","version":"57db62a130ce69e6f3a870cf1119d8f860391f97","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/s390/crypto/zcrypt_msgtype6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B376ADEA-99DD-4C34-B0B2-7362FBE63A29","versionEndExcluding":"6.18.22","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: Fix memory leak with CCA cards used as accelerator\n\nTests showed that there is a memory leak if CCA cards are used as\naccelerator for clear key RSA requests (ME and CRT). With the last\nrework for the memory allocation the AP messages are allocated by\nap_init_apmsg() but for some reason on two places (ME and CRT) the\nolder allocation was still in place. So the first allocation simple\nwas never freed."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ns390/zcrypt: Corrección de fuga de memoria con tarjetas CCA usadas como acelerador\n\nLas pruebas mostraron que hay una fuga de memoria si las tarjetas CCA se usan como acelerador para solicitudes RSA de clave clara (ME y CRT). Con la última reestructuración para la asignación de memoria, los mensajes AP son asignados por ap_init_apmsg(), pero por alguna razón en dos lugares (ME y CRT) la asignación anterior seguía en su lugar. Así que la primera asignación simplemente nunca fue liberada."}],"id":"CVE-2026-31746","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.363","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1650268579e1113b30402dbcca4dba6589a0fccf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/586222c37d4027dbf60a604fbe820184fee7c1c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ace37bfec3822033e59fff390f2ff99fc96ebe4f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8d46f17c2fc7d25c18e60c008928aecab26184d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31747.json b/data/2026/CVE-2026-31747.json
index c64caae0f8..62f5ec1c77 100644
--- a/data/2026/CVE-2026-31747.json
+++ b/data/2026/CVE-2026-31747.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/drivers/me4000.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"64b24b713e1a3ea6624480594b4f8c2ff86502f2","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"f72b5567f7c117b46b4058dc6a0c7554f8565561","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"1603dd471f47762e9d1f52304edb3e49a7e62655","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"eae19cab44204537f79146f15a51811b13227c38","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/drivers/me4000.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"86625D80-8DDF-4C85-86FD-F543ECDDFBA4","versionEndExcluding":"5.10.253","versionStartIncluding":"3.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me4000: Fix potential overrun of firmware buffer\n\n`me4000_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`.  It is possible for it to overrun the source\nbuffer because it blindly trusts the file format.  It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream.  On failure, log an error and\nreturn `-EINVAL`.\n\nNote: The firmware loading was totally broken before commit ac584af59945\n(\"staging: comedi: me4000: fix firmware downloading\"), but that is the\nmost sensible target for this fix."}],"id":"CVE-2026-31747","lastModified":"2026-06-17T10:34:23.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.463","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1603dd471f47762e9d1f52304edb3e49a7e62655"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64b24b713e1a3ea6624480594b4f8c2ff86502f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eae19cab44204537f79146f15a51811b13227c38"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f72b5567f7c117b46b4058dc6a0c7554f8565561"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/drivers/me4000.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"64b24b713e1a3ea6624480594b4f8c2ff86502f2","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"f72b5567f7c117b46b4058dc6a0c7554f8565561","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"1603dd471f47762e9d1f52304edb3e49a7e62655","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"eae19cab44204537f79146f15a51811b13227c38","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"},{"lessThan":"3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7","status":"affected","version":"ac584af599452748187cf6d7865b1607c54ee443","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/drivers/me4000.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"86625D80-8DDF-4C85-86FD-F543ECDDFBA4","versionEndExcluding":"5.10.253","versionStartIncluding":"3.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me4000: Fix potential overrun of firmware buffer\n\n`me4000_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`.  It is possible for it to overrun the source\nbuffer because it blindly trusts the file format.  It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream.  On failure, log an error and\nreturn `-EINVAL`.\n\nNote: The firmware loading was totally broken before commit ac584af59945\n(\"staging: comedi: me4000: fix firmware downloading\"), but that is the\nmost sensible target for this fix."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: me4000: Corrige un posible desbordamiento del búfer de firmware\n\n“me4000_xilinx_download()” carga el firmware que fue solicitado por “request_firmware()”. Es posible que desborde el búfer de origen porque confía ciegamente en el formato del archivo. Lee una longitud de flujo de datos de los primeros 4 bytes en la variable “file_length” y lee el contenido del flujo de datos de longitud “file_length” desde el desplazamiento 16 en adelante.\n\nAñade una prueba para asegurar que el firmware suministrado sea lo suficientemente largo para contener la cabecera y el flujo de datos. En caso de fallo, registra un error y devuelve “-EINVAL”.\n\nNota: La carga del firmware estaba totalmente rota antes del commit ac584af59945 (’staging: comedi: me4000: fix firmware downloading’), pero ese es el objetivo más sensato para esta corrección."}],"id":"CVE-2026-31747","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.463","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1603dd471f47762e9d1f52304edb3e49a7e62655"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64b24b713e1a3ea6624480594b4f8c2ff86502f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eae19cab44204537f79146f15a51811b13227c38"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f72b5567f7c117b46b4058dc6a0c7554f8565561"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31748.json b/data/2026/CVE-2026-31748.json
index 057a5426ef..7e6cf8e982 100644
--- a/data/2026/CVE-2026-31748.json
+++ b/data/2026/CVE-2026-31748.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/drivers/me_daq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2fc25a4c2e055cd42ea39a1b42c89bfef70e0319","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"9f39fa07259eb342908e4aa0271dee038a8ce4f8","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"c16ac4e173a05011437a2d868f70cc415339065a","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"1bf8761eb59e94bf7b8c17b2a1ee48f14378b172","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"a47ae40339c1048f519df33ff8840731720f57cb","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"cc797d4821c754c701d9714b58bea947e31dbbe0","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/drivers/me_daq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.29"},{"lessThan":"2.6.29","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0C1B1C38-DBED-4FC4-AE7D-B0A2622E224F","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me_daq: Fix potential overrun of firmware buffer\n\n`me2600_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`.  It is possible for it to overrun the source\nbuffer because it blindly trusts the file format.  It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.  Although it checks that the supplied firmware is at least 16\nbytes long, it does not check that it is long enough to contain the data\nstream.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream.  On failure, log an error and\nreturn `-EINVAL`."}],"id":"CVE-2026-31748","lastModified":"2026-06-17T10:34:23.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.593","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/drivers/me_daq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2fc25a4c2e055cd42ea39a1b42c89bfef70e0319","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"9f39fa07259eb342908e4aa0271dee038a8ce4f8","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"c16ac4e173a05011437a2d868f70cc415339065a","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"1bf8761eb59e94bf7b8c17b2a1ee48f14378b172","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"a47ae40339c1048f519df33ff8840731720f57cb","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"},{"lessThan":"cc797d4821c754c701d9714b58bea947e31dbbe0","status":"affected","version":"85acac61096f946a78cf0c4b65f7cebe580693b6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/drivers/me_daq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.29"},{"lessThan":"2.6.29","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0C1B1C38-DBED-4FC4-AE7D-B0A2622E224F","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me_daq: Fix potential overrun of firmware buffer\n\n`me2600_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`.  It is possible for it to overrun the source\nbuffer because it blindly trusts the file format.  It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.  Although it checks that the supplied firmware is at least 16\nbytes long, it does not check that it is long enough to contain the data\nstream.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream.  On failure, log an error and\nreturn `-EINVAL`."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: me_daq: Soluciona un posible desbordamiento del búfer de firmware\n\n’me2600_xilinx_download()’ carga el firmware que fue solicitado por ’request_firmware()’. Es posible que desborde el búfer de origen porque confía ciegamente en el formato del archivo. Lee una longitud de flujo de datos de los primeros 4 bytes en la variable ’file_length’ y lee el contenido del flujo de datos de longitud ’file_length’ desde el desplazamiento 16 en adelante. Aunque comprueba que el firmware suministrado tiene al menos 16 bytes de longitud, no comprueba que sea lo suficientemente largo para contener el flujo de datos.\n\nAñade una prueba para asegurar que el firmware suministrado sea lo suficientemente largo para contener la cabecera y el flujo de datos. En caso de fallo, registra un error y devuelve ’-EINVAL’."}],"id":"CVE-2026-31748","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.593","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31749.json b/data/2026/CVE-2026-31749.json
index 985ecdd240..efc573c458 100644
--- a/data/2026/CVE-2026-31749.json
+++ b/data/2026/CVE-2026-31749.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/drivers/ni_atmio16d.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a01dd339ea6ac58b0967a50085622a6017351140","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"933a2d6a95f9bfb203e562c9be1dd990c735535c","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"5d8d88c8c0eec230de8f1f60e0920a4337939a88","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"f517646e008fe99ca1800601cd011b110f8684ae","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"3848ae00b1642e2c98ff8cbfd2d3b38c6f53b5c3","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"43c68a2c7cc35b7c2a83c285cb4ad3d472b8caa2","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"d07d97ca4f7fac467cdcf4a012690853958b7e89","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"101ab946b79ad83b36d5cfd47de587492a80acf0","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/drivers/ni_atmio16d.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14B74C0E-F4B9-41B2-B587-14056AC9B646","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: ni_atmio16d: Fix invalid clean-up after failed attach\n\nIf the driver's COMEDI \"attach\" handler function (`atmio16d_attach()`)\nreturns an error, the COMEDI core will call the driver's \"detach\"\nhandler function (`atmio16d_detach()`) to clean up.  This calls\n`reset_atmio16d()` unconditionally, but depending on where the error\noccurred in the attach handler, the device may not have been\nsufficiently initialized to call `reset_atmio16d()`.  It uses\n`dev->iobase` as the I/O port base address and `dev->private` as the\npointer to the COMEDI device's private data structure.  `dev->iobase`\nmay still be set to its initial value of 0, which would result in\nundesired writes to low I/O port addresses.  `dev->private` may still be\n`NULL`, which would result in null pointer dereferences.\n\nFix `atmio16d_detach()` by checking that `dev->private` is valid\n(non-null) before calling `reset_atmio16d()`.  This implies that\n`dev->iobase` was set correctly since that is set up before\n`dev->private`."}],"id":"CVE-2026-31749","lastModified":"2026-06-17T10:34:23.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.723","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/101ab946b79ad83b36d5cfd47de587492a80acf0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3848ae00b1642e2c98ff8cbfd2d3b38c6f53b5c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/43c68a2c7cc35b7c2a83c285cb4ad3d472b8caa2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d8d88c8c0eec230de8f1f60e0920a4337939a88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/933a2d6a95f9bfb203e562c9be1dd990c735535c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a01dd339ea6ac58b0967a50085622a6017351140"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d07d97ca4f7fac467cdcf4a012690853958b7e89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f517646e008fe99ca1800601cd011b110f8684ae"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/drivers/ni_atmio16d.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a01dd339ea6ac58b0967a50085622a6017351140","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"933a2d6a95f9bfb203e562c9be1dd990c735535c","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"5d8d88c8c0eec230de8f1f60e0920a4337939a88","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"f517646e008fe99ca1800601cd011b110f8684ae","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"3848ae00b1642e2c98ff8cbfd2d3b38c6f53b5c3","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"43c68a2c7cc35b7c2a83c285cb4ad3d472b8caa2","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"d07d97ca4f7fac467cdcf4a012690853958b7e89","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"},{"lessThan":"101ab946b79ad83b36d5cfd47de587492a80acf0","status":"affected","version":"2323b276308a5da5774b778f39c7fd94b2a3022a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/drivers/ni_atmio16d.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14B74C0E-F4B9-41B2-B587-14056AC9B646","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: ni_atmio16d: Fix invalid clean-up after failed attach\n\nIf the driver's COMEDI \"attach\" handler function (`atmio16d_attach()`)\nreturns an error, the COMEDI core will call the driver's \"detach\"\nhandler function (`atmio16d_detach()`) to clean up.  This calls\n`reset_atmio16d()` unconditionally, but depending on where the error\noccurred in the attach handler, the device may not have been\nsufficiently initialized to call `reset_atmio16d()`.  It uses\n`dev->iobase` as the I/O port base address and `dev->private` as the\npointer to the COMEDI device's private data structure.  `dev->iobase`\nmay still be set to its initial value of 0, which would result in\nundesired writes to low I/O port addresses.  `dev->private` may still be\n`NULL`, which would result in null pointer dereferences.\n\nFix `atmio16d_detach()` by checking that `dev->private` is valid\n(non-null) before calling `reset_atmio16d()`.  This implies that\n`dev->iobase` was set correctly since that is set up before\n`dev->private`."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: ni_atmio16d: Corrección de limpieza inválida después de un ’attach’ fallido\n\nSi la función gestora ’attach’ de COMEDI del controlador (’atmio16d_attach()’) devuelve un error, el núcleo de COMEDI llamará a la función gestora ’detach’ del controlador (’atmio16d_detach()’) para realizar la limpieza. Esto llama a ’reset_atmio16d()’ incondicionalmente, pero dependiendo de dónde ocurrió el error en el gestor de ’attach’, el dispositivo podría no haber sido inicializado suficientemente para llamar a ’reset_atmio16d()’. Utiliza ’dev  ->  iobase’ como la dirección base del puerto de E/S y ’dev  ->  private’ como el puntero a la estructura de datos privada del dispositivo COMEDI. ’dev  ->  iobase’ podría seguir establecido a su valor inicial de 0, lo que resultaría en escrituras no deseadas a direcciones de puerto de E/S bajas. ’dev  ->  private’ podría seguir siendo ’NULL’, lo que resultaría en desreferencias de puntero nulo.\n\nCorrige ’atmio16d_detach()’ comprobando que ’dev  ->  private’ es válido (no nulo) antes de llamar a ’reset_atmio16d()’. Esto implica que ’dev  ->  iobase’ se configuró correctamente ya que eso se configura antes que ’dev  ->  private’."}],"id":"CVE-2026-31749","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.723","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/101ab946b79ad83b36d5cfd47de587492a80acf0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3848ae00b1642e2c98ff8cbfd2d3b38c6f53b5c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/43c68a2c7cc35b7c2a83c285cb4ad3d472b8caa2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d8d88c8c0eec230de8f1f60e0920a4337939a88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/933a2d6a95f9bfb203e562c9be1dd990c735535c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a01dd339ea6ac58b0967a50085622a6017351140"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d07d97ca4f7fac467cdcf4a012690853958b7e89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f517646e008fe99ca1800601cd011b110f8684ae"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31750.json b/data/2026/CVE-2026-31750.json
index 22d202aa58..1de04f131c 100644
--- a/data/2026/CVE-2026-31750.json
+++ b/data/2026/CVE-2026-31750.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/comedi_fops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"830c848aba9f047eb6b34288975ebeb8e8621451","status":"affected","version":"4e1da516debbe6a573ffa0392e2809d180d0575c","versionType":"git"},{"lessThan":"29f644f14b89e6c4965e3c89251929e451190a66","status":"affected","version":"4e1da516debbe6a573ffa0392e2809d180d0575c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/comedi_fops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: runflags cannot determine whether to reclaim chanlist\n\nsyzbot reported a memory leak [1], because commit 4e1da516debb (\"comedi:\nAdd reference counting for Comedi command handling\") did not consider\nthe exceptional exit case in do_cmd_ioctl() where runflags is not set.\nThis caused chanlist not to be properly freed by do_become_nonbusy(),\nas it only frees chanlist when runflags is correctly set.\n\nAdded a check in do_become_nonbusy() for the case where runflags is not\nset, to properly free the chanlist memory.\n\n[1]\nBUG: memory leak\n  backtrace (crc 844a0efa):\n    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]\n    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890\n    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]"}],"id":"CVE-2026-31750","lastModified":"2026-06-17T10:34:23.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.850","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29f644f14b89e6c4965e3c89251929e451190a66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/830c848aba9f047eb6b34288975ebeb8e8621451"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/comedi_fops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"830c848aba9f047eb6b34288975ebeb8e8621451","status":"affected","version":"4e1da516debbe6a573ffa0392e2809d180d0575c","versionType":"git"},{"lessThan":"29f644f14b89e6c4965e3c89251929e451190a66","status":"affected","version":"4e1da516debbe6a573ffa0392e2809d180d0575c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/comedi_fops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: runflags cannot determine whether to reclaim chanlist\n\nsyzbot reported a memory leak [1], because commit 4e1da516debb (\"comedi:\nAdd reference counting for Comedi command handling\") did not consider\nthe exceptional exit case in do_cmd_ioctl() where runflags is not set.\nThis caused chanlist not to be properly freed by do_become_nonbusy(),\nas it only frees chanlist when runflags is correctly set.\n\nAdded a check in do_become_nonbusy() for the case where runflags is not\nset, to properly free the chanlist memory.\n\n[1]\nBUG: memory leak\n  backtrace (crc 844a0efa):\n    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]\n    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890\n    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: runflags no puede determinar si debe reclamar chanlist\n\nsyzbot informó de una fuga de memoria [1], porque el commit 4e1da516debb (’comedi: Add reference counting for Comedi command handling’) no consideró el caso de salida excepcional en do_cmd_ioctl() donde runflags no está establecido. Esto causó que chanlist no fuera liberado correctamente por do_become_nonbusy(), ya que solo libera chanlist cuando runflags está correctamente establecido.\n\nSe añadió una comprobación en do_become_nonbusy() para el caso en que runflags no está establecido, para liberar correctamente la memoria de chanlist.\n\n[1]\nERROR: fuga de memoria\n  rastreo (crc 844a0efa):\n    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]\n    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890\n    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]"}],"id":"CVE-2026-31750","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.850","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29f644f14b89e6c4965e3c89251929e451190a66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/830c848aba9f047eb6b34288975ebeb8e8621451"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31751.json b/data/2026/CVE-2026-31751.json
index 3ec88b3558..6df810c559 100644
--- a/data/2026/CVE-2026-31751.json
+++ b/data/2026/CVE-2026-31751.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/drivers/dt2815.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8d63161837f1bf8810dbcd2a583c2bbf5ca6d733","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"d2a786efdb9971f2a647724625da5bbecc994dc9","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"0dcf33994b8dcf3db36530fb7e2cf9f89e5cbac3","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"d5d9df8b08d68d083ac57abc2c887dfb1f31af63","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"65c528fbeddd88478c210052f6c7b21be4973156","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"34c8b3a91bdfbe4573650b4cd750ef639101fdc5","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"34b13250c618d7441508c6ef369144aa8a9b9bfa","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"93853512f565e625df2397f0d8050d6aafd7c3ad","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/drivers/dt2815.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14B74C0E-F4B9-41B2-B587-14056AC9B646","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: dt2815: add hardware detection to prevent crash\n\nThe dt2815 driver crashes when attached to I/O ports without actual\nhardware present. This occurs because syzkaller or users can attach\nthe driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.\n\nWhen no hardware exists at the specified port, inb() operations return\n0xff (floating bus), but outb() operations can trigger page faults due\nto undefined behavior, especially under race conditions:\n\n  BUG: unable to handle page fault for address: 000000007fffff90\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  RIP: 0010:dt2815_attach+0x6e0/0x1110\n\nAdd hardware detection by reading the status register before attempting\nany write operations. If the read returns 0xff, assume no hardware is\npresent and fail the attach with -ENODEV. This prevents crashes from\noutb() operations on non-existent hardware."}],"id":"CVE-2026-31751","lastModified":"2026-06-17T10:34:23.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.960","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0dcf33994b8dcf3db36530fb7e2cf9f89e5cbac3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34b13250c618d7441508c6ef369144aa8a9b9bfa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34c8b3a91bdfbe4573650b4cd750ef639101fdc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65c528fbeddd88478c210052f6c7b21be4973156"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d63161837f1bf8810dbcd2a583c2bbf5ca6d733"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93853512f565e625df2397f0d8050d6aafd7c3ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2a786efdb9971f2a647724625da5bbecc994dc9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5d9df8b08d68d083ac57abc2c887dfb1f31af63"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/comedi/drivers/dt2815.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8d63161837f1bf8810dbcd2a583c2bbf5ca6d733","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"d2a786efdb9971f2a647724625da5bbecc994dc9","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"0dcf33994b8dcf3db36530fb7e2cf9f89e5cbac3","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"d5d9df8b08d68d083ac57abc2c887dfb1f31af63","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"65c528fbeddd88478c210052f6c7b21be4973156","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"34c8b3a91bdfbe4573650b4cd750ef639101fdc5","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"34b13250c618d7441508c6ef369144aa8a9b9bfa","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"},{"lessThan":"93853512f565e625df2397f0d8050d6aafd7c3ad","status":"affected","version":"d6a929b7608ae157cef86d00cc580d1038f0b985","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/comedi/drivers/dt2815.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14B74C0E-F4B9-41B2-B587-14056AC9B646","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: dt2815: add hardware detection to prevent crash\n\nThe dt2815 driver crashes when attached to I/O ports without actual\nhardware present. This occurs because syzkaller or users can attach\nthe driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.\n\nWhen no hardware exists at the specified port, inb() operations return\n0xff (floating bus), but outb() operations can trigger page faults due\nto undefined behavior, especially under race conditions:\n\n  BUG: unable to handle page fault for address: 000000007fffff90\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  RIP: 0010:dt2815_attach+0x6e0/0x1110\n\nAdd hardware detection by reading the status register before attempting\nany write operations. If the read returns 0xff, assume no hardware is\npresent and fail the attach with -ENODEV. This prevents crashes from\noutb() operations on non-existent hardware."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncomedi: dt2815: añadir detección de hardware para prevenir un fallo\n\nEl controlador dt2815 falla cuando se adjunta a puertos de E/S sin hardware real presente. Esto ocurre porque syzkaller o los usuarios pueden adjuntar el controlador a direcciones de E/S arbitrarias a través de COMEDI_DEVCONFIG ioctl.\n\nCuando no existe hardware en el puerto especificado, las operaciones inb() devuelven 0xff (bus flotante), pero las operaciones outb() pueden desencadenar fallos de página debido a un comportamiento indefinido, especialmente bajo condiciones de carrera:\n\n  BUG: incapaz de manejar fallo de página para la dirección: 000000007fffff90\n  #PF: acceso de escritura de supervisor en modo kernel\n  #PF: código_de_error(0x 0002) - página no presente\n  RIP: 0010:dt2815_attach+0x6e0/0x 1110\n\nAñadir detección de hardware leyendo el registro de estado antes de intentar cualquier operación de escritura. Si la lectura devuelve 0xff, asumir que no hay hardware presente y fallar la adjunción con -ENODEV. Esto previene fallos de operaciones outb() en hardware no existente."}],"id":"CVE-2026-31751","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:37.960","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0dcf33994b8dcf3db36530fb7e2cf9f89e5cbac3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34b13250c618d7441508c6ef369144aa8a9b9bfa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34c8b3a91bdfbe4573650b4cd750ef639101fdc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65c528fbeddd88478c210052f6c7b21be4973156"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d63161837f1bf8810dbcd2a583c2bbf5ca6d733"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93853512f565e625df2397f0d8050d6aafd7c3ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2a786efdb9971f2a647724625da5bbecc994dc9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5d9df8b08d68d083ac57abc2c887dfb1f31af63"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31752.json b/data/2026/CVE-2026-31752.json
index 1f37818ef1..20a97e90cf 100644
--- a/data/2026/CVE-2026-31752.json
+++ b/data/2026/CVE-2026-31752.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bridge/br_arp_nd_proxy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"82a42eceec7c6bdb0e0da94c0542a173b7ea57f2","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"259466f76f5a2148aff11134e68f4b4c6d52725b","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"c49b9256bbacb6a135654aebd12e4c0e87166b7c","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"837392a38445729c22e03d3abcf33f07763efd85","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"e71303a9190496136e240c4f2872b7b0b16027a7","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"850837965af15707fd3142c1cf3c5bfaf022299b","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bridge/br_arp_nd_proxy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"202FFB00-4CA7-44CB-ACA1-E88A2BF2264B","versionEndExcluding":"5.10.253","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyond the computed\noption span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address."}],"id":"CVE-2026-31752","lastModified":"2026-11-10T13:19:04.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31752","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:49.446519Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:38.090","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/259466f76f5a2148aff11134e68f4b4c6d52725b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82a42eceec7c6bdb0e0da94c0542a173b7ea57f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/837392a38445729c22e03d3abcf33f07763efd85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/850837965af15707fd3142c1cf3c5bfaf022299b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c49b9256bbacb6a135654aebd12e4c0e87166b7c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e71303a9190496136e240c4f2872b7b0b16027a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bridge/br_arp_nd_proxy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"82a42eceec7c6bdb0e0da94c0542a173b7ea57f2","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"259466f76f5a2148aff11134e68f4b4c6d52725b","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"c49b9256bbacb6a135654aebd12e4c0e87166b7c","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"837392a38445729c22e03d3abcf33f07763efd85","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"e71303a9190496136e240c4f2872b7b0b16027a7","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"850837965af15707fd3142c1cf3c5bfaf022299b","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bridge/br_arp_nd_proxy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"202FFB00-4CA7-44CB-ACA1-E88A2BF2264B","versionEndExcluding":"5.10.253","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyond the computed\noption span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbridge: br_nd_send: validar longitudes de opciones ND\n\nbr_nd_send() recorre las opciones ND según las longitudes proporcionadas por la opción.\nUna opción malformada puede hacer que el analizador avance más allá del alcance de opción calculado o utilice una carga útil de opción LLADDR de origen demasiado corta.\n\nValidar las longitudes de las opciones contra el área de opciones NS restante antes de avanzar, y solo leer LLADDR de origen cuando la opción sea lo suficientemente grande para una dirección Ethernet."}],"id":"CVE-2026-31752","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31752","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:49.446519Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:38.090","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/259466f76f5a2148aff11134e68f4b4c6d52725b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82a42eceec7c6bdb0e0da94c0542a173b7ea57f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/837392a38445729c22e03d3abcf33f07763efd85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/850837965af15707fd3142c1cf3c5bfaf022299b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c49b9256bbacb6a135654aebd12e4c0e87166b7c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e71303a9190496136e240c4f2872b7b0b16027a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31753.json b/data/2026/CVE-2026-31753.json
index 377cb8c545..7583d38912 100644
--- a/data/2026/CVE-2026-31753.json
+++ b/data/2026/CVE-2026-31753.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/auxdisplay/line-display.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"625fdac41cfc4ca9e1774a0d31d7985aec2c1d66","status":"affected","version":"66c93809487e62c4f59ef08625a3fbc0a7de6dd2","versionType":"git"},{"lessThan":"7f138de156b20d9f9da6f72f90b63c01941d97d3","status":"affected","version":"66c93809487e62c4f59ef08625a3fbc0a7de6dd2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/auxdisplay/line-display.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nauxdisplay: line-display: fix NULL dereference in linedisp_release\n\nlinedisp_release() currently retrieves the enclosing struct linedisp via\nto_linedisp(). That lookup depends on the attachment list, but the\nattachment may already have been removed before put_device() invokes the\nrelease callback. This can happen in linedisp_unregister(), and can also\nbe reached from some linedisp_register() error paths.\n\nIn that case, to_linedisp() returns NULL and linedisp_release()\ndereferences it while freeing the display resources.\n\nThe struct device released here is the embedded linedisp->dev used by\nlinedisp_register(), so retrieve the enclosing object directly with\ncontainer_of() instead."}],"id":"CVE-2026-31753","lastModified":"2026-06-17T10:34:23.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.223","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/625fdac41cfc4ca9e1774a0d31d7985aec2c1d66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7f138de156b20d9f9da6f72f90b63c01941d97d3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/auxdisplay/line-display.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"625fdac41cfc4ca9e1774a0d31d7985aec2c1d66","status":"affected","version":"66c93809487e62c4f59ef08625a3fbc0a7de6dd2","versionType":"git"},{"lessThan":"7f138de156b20d9f9da6f72f90b63c01941d97d3","status":"affected","version":"66c93809487e62c4f59ef08625a3fbc0a7de6dd2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/auxdisplay/line-display.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nauxdisplay: line-display: fix NULL dereference in linedisp_release\n\nlinedisp_release() currently retrieves the enclosing struct linedisp via\nto_linedisp(). That lookup depends on the attachment list, but the\nattachment may already have been removed before put_device() invokes the\nrelease callback. This can happen in linedisp_unregister(), and can also\nbe reached from some linedisp_register() error paths.\n\nIn that case, to_linedisp() returns NULL and linedisp_release()\ndereferences it while freeing the display resources.\n\nThe struct device released here is the embedded linedisp->dev used by\nlinedisp_register(), so retrieve the enclosing object directly with\ncontainer_of() instead."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nauxdisplay: line-display: corregir desreferencia NULL en linedisp_release\n\nlinedisp_release() actualmente recupera la struct linedisp contenedora a través de to_linedisp(). Esa búsqueda depende de la lista de adjuntos, pero el adjunto ya podría haber sido eliminado antes de que put_device() invoque la función de devolución de llamada de liberación. Esto puede ocurrir en linedisp_unregister(), y también se puede alcanzar desde algunas rutas de error de linedisp_register().\n\nEn ese caso, to_linedisp() devuelve NULL y linedisp_release() lo desreferencia mientras libera los recursos de la pantalla.\n\nLa struct device liberada aquí es el linedisp  ->  dev incrustado utilizado por linedisp_register(), así que recupera el objeto contenedor directamente con container_of() en su lugar."}],"id":"CVE-2026-31753","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.223","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/625fdac41cfc4ca9e1774a0d31d7985aec2c1d66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7f138de156b20d9f9da6f72f90b63c01941d97d3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31754.json b/data/2026/CVE-2026-31754.json
index a682383a98..0b4475d834 100644
--- a/data/2026/CVE-2026-31754.json
+++ b/data/2026/CVE-2026-31754.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/cdns3/cdns3-gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fb7110a052467098967284ef14d306810b354937","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"9b1d301fbae837bf6979a19030b81d869bb15f7a","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"cfca84f5986afceb63a3adf39d4a98e915aebbc2","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"5a85599ca4d2584d89dc69f4fc49303b75a42338","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"c32f8748d70c8fc77676ad92ed76cede17bf2c48","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/cdns3/cdns3-gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F3F9E871-B1BA-4390-A3FF-0AF749DD62EE","versionEndExcluding":"5.15.203","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix state inconsistency on gadget init failure\n\nWhen cdns3_gadget_start() fails, the DRD hardware is left in gadget mode\nwhile software state remains INACTIVE, creating hardware/software state\ninconsistency.\n\nWhen switching to host mode via sysfs:\n  echo host > /sys/class/usb_role/13180000.usb-role-switch/role\n\nThe role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,\nso cdns_role_stop() skips cleanup because state is still INACTIVE.\nThis violates the DRD controller design specification (Figure22),\nwhich requires returning to idle state before switching roles.\n\nThis leads to a synchronous external abort in xhci_gen_setup() when\nsetting up the host controller:\n\n[  516.440698] configfs-gadget 13180000.usb: failed to start g1: -19\n[  516.442035] cdns-usb3 13180000.usb: Failed to add gadget\n[  516.443278] cdns-usb3 13180000.usb: set role 2 has failed\n...\n[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller\n[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP\n[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408\n[ 1301.393391] backtrace:\n    ...\n    xhci_gen_setup+0xa4/0x408    <-- CRASH\n    xhci_plat_setup+0x44/0x58\n    usb_add_hcd+0x284/0x678\n    ...\n    cdns_role_set+0x9c/0xbc        <-- Role switch\n\nFix by calling cdns_drd_gadget_off() in the error path to properly\nclean up the DRD gadget state."}],"id":"CVE-2026-31754","lastModified":"2026-06-17T10:34:24.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a85599ca4d2584d89dc69f4fc49303b75a42338"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b1d301fbae837bf6979a19030b81d869bb15f7a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c32f8748d70c8fc77676ad92ed76cede17bf2c48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cfca84f5986afceb63a3adf39d4a98e915aebbc2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb7110a052467098967284ef14d306810b354937"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/cdns3/cdns3-gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fb7110a052467098967284ef14d306810b354937","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"9b1d301fbae837bf6979a19030b81d869bb15f7a","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"cfca84f5986afceb63a3adf39d4a98e915aebbc2","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"5a85599ca4d2584d89dc69f4fc49303b75a42338","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"c32f8748d70c8fc77676ad92ed76cede17bf2c48","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/cdns3/cdns3-gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F3F9E871-B1BA-4390-A3FF-0AF749DD62EE","versionEndExcluding":"5.15.203","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix state inconsistency on gadget init failure\n\nWhen cdns3_gadget_start() fails, the DRD hardware is left in gadget mode\nwhile software state remains INACTIVE, creating hardware/software state\ninconsistency.\n\nWhen switching to host mode via sysfs:\n  echo host > /sys/class/usb_role/13180000.usb-role-switch/role\n\nThe role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,\nso cdns_role_stop() skips cleanup because state is still INACTIVE.\nThis violates the DRD controller design specification (Figure22),\nwhich requires returning to idle state before switching roles.\n\nThis leads to a synchronous external abort in xhci_gen_setup() when\nsetting up the host controller:\n\n[  516.440698] configfs-gadget 13180000.usb: failed to start g1: -19\n[  516.442035] cdns-usb3 13180000.usb: Failed to add gadget\n[  516.443278] cdns-usb3 13180000.usb: set role 2 has failed\n...\n[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller\n[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP\n[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408\n[ 1301.393391] backtrace:\n    ...\n    xhci_gen_setup+0xa4/0x408    <-- CRASH\n    xhci_plat_setup+0x44/0x58\n    usb_add_hcd+0x284/0x678\n    ...\n    cdns_role_set+0x9c/0xbc        <-- Role switch\n\nFix by calling cdns_drd_gadget_off() in the error path to properly\nclean up the DRD gadget state."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: cdns3: gadget: corregir inconsistencia de estado en fallo de inicialización del gadget\n\nCuando cdns3_gadget_start() falla, el hardware DRD queda en modo gadget mientras el estado del software permanece INACTIVO, creando una inconsistencia de estado hardware/software.\n\nAl cambiar a modo host a través de sysfs:\n  echo host > /sys/class/usb_role/13180000.usb-role-switch/role\n\nEl estado del rol no se establece en CDNS_ROLE_STATE_ACTIVE debido al error, por lo que cdns_role_stop() omite la limpieza porque el estado sigue siendo INACTIVO. Esto viola la especificación de diseño del controlador DRD (Figura22), que requiere volver al estado inactivo antes de cambiar de rol.\n\nEsto conduce a un aborto externo síncrono en xhci_gen_setup() al configurar el controlador host:\n\n[  516.440698] configfs-gadget 13180000.usb: failed to start g1: -19\n[  516.442035] cdns-usb3 13180000.usb: Failed to add gadget\n[  516.443278] cdns-usb3 13180000.usb: set role 2 has failed\n...\n[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller\n[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP\n[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408\n[ 1301.393391] backtrace:\n    ...\n    xhci_gen_setup+0xa4/0x408      <-  - CRASH\n    xhci_plat_setup+0x44/0x58\n    usb_add_hcd+0x284/0x678\n    ...\n    cdns_role_set+0x9c/0xbc          <-  - Cambio de rol\n\nSolución llamando a cdns_drd_gadget_off() en la ruta de error para limpiar correctamente el estado del gadget DRD."}],"id":"CVE-2026-31754","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a85599ca4d2584d89dc69f4fc49303b75a42338"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b1d301fbae837bf6979a19030b81d869bb15f7a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c32f8748d70c8fc77676ad92ed76cede17bf2c48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cfca84f5986afceb63a3adf39d4a98e915aebbc2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb7110a052467098967284ef14d306810b354937"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31755.json b/data/2026/CVE-2026-31755.json
index 7ec63240ce..38b087c74c 100644
--- a/data/2026/CVE-2026-31755.json
+++ b/data/2026/CVE-2026-31755.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/cdns3/cdns3-gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3cf0580a09d417eab41ce914a11f9cde3a121871","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"3d1433fe34b224b90259e207e5389e95b504ef04","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"d61446dfc9d387775bb1b95b081953201b9222af","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"390536cc6af4ca5566bc3bf1f8b704700380cd2c","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"7f6f127b9bc34bed35f56faf7ecb1561d6b39000","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/cdns3/cdns3-gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F3F9E871-B1BA-4390-A3FF-0AF749DD62EE","versionEndExcluding":"5.15.203","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix NULL pointer dereference in ep_queue\n\nWhen the gadget endpoint is disabled or not yet configured, the ep->desc\npointer can be NULL. This leads to a NULL pointer dereference when\n__cdns3_gadget_ep_queue() is called, causing a kernel crash.\n\nAdd a check to return -ESHUTDOWN if ep->desc is NULL, which is the\nstandard return code for unconfigured endpoints.\n\nThis prevents potential crashes when ep_queue is called on endpoints\nthat are not ready."}],"id":"CVE-2026-31755","lastModified":"2026-07-04T12:16:55.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/390536cc6af4ca5566bc3bf1f8b704700380cd2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3cf0580a09d417eab41ce914a11f9cde3a121871"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d1433fe34b224b90259e207e5389e95b504ef04"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7f6f127b9bc34bed35f56faf7ecb1561d6b39000"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d61446dfc9d387775bb1b95b081953201b9222af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/cdns3/cdns3-gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3cf0580a09d417eab41ce914a11f9cde3a121871","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"3d1433fe34b224b90259e207e5389e95b504ef04","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"d61446dfc9d387775bb1b95b081953201b9222af","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"390536cc6af4ca5566bc3bf1f8b704700380cd2c","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"},{"lessThan":"7f6f127b9bc34bed35f56faf7ecb1561d6b39000","status":"affected","version":"7733f6c32e36ff9d7adadf40001039bf219b1cbe","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/cdns3/cdns3-gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F3F9E871-B1BA-4390-A3FF-0AF749DD62EE","versionEndExcluding":"5.15.203","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix NULL pointer dereference in ep_queue\n\nWhen the gadget endpoint is disabled or not yet configured, the ep->desc\npointer can be NULL. This leads to a NULL pointer dereference when\n__cdns3_gadget_ep_queue() is called, causing a kernel crash.\n\nAdd a check to return -ESHUTDOWN if ep->desc is NULL, which is the\nstandard return code for unconfigured endpoints.\n\nThis prevents potential crashes when ep_queue is called on endpoints\nthat are not ready."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nusb: cdns3: gadget: corrección de desreferencia de puntero NULL en ep_queue\n\nCuando el endpoint del gadget está deshabilitado o aún no configurado, el puntero ep  ->  desc puede ser NULL. Esto provoca una desreferencia de puntero NULL cuando se llama a __cdns3_gadget_ep_queue(), causando un fallo del kernel.\n\nSe añade una comprobación para devolver -ESHUTDOWN si ep  ->  desc es NULL, que es el código de retorno estándar para endpoints no configurados.\n\nEsto evita posibles fallos cuando se llama a ep_queue en endpoints que no están listos."}],"id":"CVE-2026-31755","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/390536cc6af4ca5566bc3bf1f8b704700380cd2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3cf0580a09d417eab41ce914a11f9cde3a121871"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d1433fe34b224b90259e207e5389e95b504ef04"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7f6f127b9bc34bed35f56faf7ecb1561d6b39000"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d61446dfc9d387775bb1b95b081953201b9222af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31756.json b/data/2026/CVE-2026-31756.json
index 26d109b51f..404a1c7b35 100644
--- a/data/2026/CVE-2026-31756.json
+++ b/data/2026/CVE-2026-31756.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/dwc2/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e9fcca3e87463013d595c65c2189ffaa32ad3b50","status":"affected","version":"5cb3cb3db317c58d50b68f3ca3bb8343ea9d1acd","versionType":"git"},{"lessThan":"8ffe31acb3b77a30ae34d01719a269881569fb7f","status":"affected","version":"1ac826cebc2776f91569f2aa9c9c3da2375d2096","versionType":"git"},{"lessThan":"beab10429439e20708036a66fb0d97ffb79da6a1","status":"affected","version":"41732f9febdccb4f9b87c13cb915d717d68ccafd","versionType":"git"},{"lessThan":"4ed9d2dd9f29828c311db6ec4b8e0d34bfd6d6a4","status":"affected","version":"ba78c2b3254c4a458c01776612e8a573e12f8d26","versionType":"git"},{"lessThan":"61937f686290494998236c680ce0836b8dd63a3f","status":"affected","version":"af076a41f8a28faf9ceb9dd2d88aef2c202ef39a","versionType":"git"},{"lessThan":"51b62286fc668c6eb74dee7624ec0beec3c5a0ed","status":"affected","version":"af076a41f8a28faf9ceb9dd2d88aef2c202ef39a","versionType":"git"},{"lessThan":"9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a","status":"affected","version":"af076a41f8a28faf9ceb9dd2d88aef2c202ef39a","versionType":"git"},{"status":"affected","version":"b39c203690fa1678daecc60f347e43c8b593b969","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.187","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.143","versionType":"semver"},{"lessThan":"6.6.134","status":"affected","version":"6.6.96","versionType":"semver"},{"lessThan":"6.12.81","status":"affected","version":"6.12.36","versionType":"semver"},{"lessThan":"6.16","status":"affected","version":"6.15.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/dwc2/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"47F2AD8D-1BF2-49F3-AB68-24C4630BAFD0","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.187","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7E908ADC-45DA-494F-9E71-A310F56EDCAF","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.143","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E220ECC5-ECBC-4EFF-B943-1DEACE981592","versionEndExcluding":"6.6.134","versionStartIncluding":"6.6.96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0FFEF924-DF26-4B6A-B663-70084F25414E","versionEndExcluding":"6.12.81","versionStartIncluding":"6.12.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8F8BB240-724D-4162-8196-2D2F2C5C8724","versionEndExcluding":"6.18.22","versionStartIncluding":"6.15.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()\n\ndwc2_gadget_exit_clock_gating() internally calls call_gadget() macro,\nwhich expects hsotg->lock to be held since it does spin_unlock/spin_lock\naround the gadget driver callback invocation.\n\nHowever, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating()\nwithout holding the lock. This leads to:\n - spin_unlock on a lock that is not held (undefined behavior)\n - The lock remaining held after dwc2_gadget_exit_clock_gating() returns,\n   causing a deadlock when spin_lock_irqsave() is called later in the\n   same function.\n\nFix this by acquiring hsotg->lock before calling\ndwc2_gadget_exit_clock_gating() and releasing it afterwards, which\nsatisfies the locking requirement of the call_gadget() macro."}],"id":"CVE-2026-31756","lastModified":"2026-06-17T10:34:24.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.580","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ed9d2dd9f29828c311db6ec4b8e0d34bfd6d6a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51b62286fc668c6eb74dee7624ec0beec3c5a0ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/61937f686290494998236c680ce0836b8dd63a3f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ffe31acb3b77a30ae34d01719a269881569fb7f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/beab10429439e20708036a66fb0d97ffb79da6a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e9fcca3e87463013d595c65c2189ffaa32ad3b50"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/dwc2/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e9fcca3e87463013d595c65c2189ffaa32ad3b50","status":"affected","version":"5cb3cb3db317c58d50b68f3ca3bb8343ea9d1acd","versionType":"git"},{"lessThan":"8ffe31acb3b77a30ae34d01719a269881569fb7f","status":"affected","version":"1ac826cebc2776f91569f2aa9c9c3da2375d2096","versionType":"git"},{"lessThan":"beab10429439e20708036a66fb0d97ffb79da6a1","status":"affected","version":"41732f9febdccb4f9b87c13cb915d717d68ccafd","versionType":"git"},{"lessThan":"4ed9d2dd9f29828c311db6ec4b8e0d34bfd6d6a4","status":"affected","version":"ba78c2b3254c4a458c01776612e8a573e12f8d26","versionType":"git"},{"lessThan":"61937f686290494998236c680ce0836b8dd63a3f","status":"affected","version":"af076a41f8a28faf9ceb9dd2d88aef2c202ef39a","versionType":"git"},{"lessThan":"51b62286fc668c6eb74dee7624ec0beec3c5a0ed","status":"affected","version":"af076a41f8a28faf9ceb9dd2d88aef2c202ef39a","versionType":"git"},{"lessThan":"9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a","status":"affected","version":"af076a41f8a28faf9ceb9dd2d88aef2c202ef39a","versionType":"git"},{"status":"affected","version":"b39c203690fa1678daecc60f347e43c8b593b969","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.187","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.143","versionType":"semver"},{"lessThan":"6.6.134","status":"affected","version":"6.6.96","versionType":"semver"},{"lessThan":"6.12.81","status":"affected","version":"6.12.36","versionType":"semver"},{"lessThan":"6.16","status":"affected","version":"6.15.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/dwc2/gadget.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"47F2AD8D-1BF2-49F3-AB68-24C4630BAFD0","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.187","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7E908ADC-45DA-494F-9E71-A310F56EDCAF","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.143","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E220ECC5-ECBC-4EFF-B943-1DEACE981592","versionEndExcluding":"6.6.134","versionStartIncluding":"6.6.96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0FFEF924-DF26-4B6A-B663-70084F25414E","versionEndExcluding":"6.12.81","versionStartIncluding":"6.12.36","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8F8BB240-724D-4162-8196-2D2F2C5C8724","versionEndExcluding":"6.18.22","versionStartIncluding":"6.15.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()\n\ndwc2_gadget_exit_clock_gating() internally calls call_gadget() macro,\nwhich expects hsotg->lock to be held since it does spin_unlock/spin_lock\naround the gadget driver callback invocation.\n\nHowever, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating()\nwithout holding the lock. This leads to:\n - spin_unlock on a lock that is not held (undefined behavior)\n - The lock remaining held after dwc2_gadget_exit_clock_gating() returns,\n   causing a deadlock when spin_lock_irqsave() is called later in the\n   same function.\n\nFix this by acquiring hsotg->lock before calling\ndwc2_gadget_exit_clock_gating() and releasing it afterwards, which\nsatisfies the locking requirement of the call_gadget() macro."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: dwc2: gadget: Corrección de desajuste de spin_lock/unlock en dwc2_hsotg_udc_stop()\n\ndwc2_gadget_exit_clock_gating() llama internamente a la macro call_gadget(), la cual espera que hsotg  ->  lock esté retenido ya que realiza spin_unlock/spin_lock alrededor de la invocación de la función de devolución de llamada del controlador del gadget.\n\nSin embargo, dwc2_hsotg_udc_stop() llama a dwc2_gadget_exit_clock_gating() sin retener el bloqueo. Esto conduce a:\n- spin_unlock en un bloqueo que no está retenido (comportamiento indefinido)\n- El bloqueo permanece retenido después de que dwc2_gadget_exit_clock_gating() retorna, causando un interbloqueo cuando spin_lock_irqsave() es llamado más tarde en la misma función.\n\nSolucione esto adquiriendo hsotg  ->  lock antes de llamar a dwc2_gadget_exit_clock_gating() y liberándolo después, lo cual satisface el requisito de bloqueo de la macro call_gadget()."}],"id":"CVE-2026-31756","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.580","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ed9d2dd9f29828c311db6ec4b8e0d34bfd6d6a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51b62286fc668c6eb74dee7624ec0beec3c5a0ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/61937f686290494998236c680ce0836b8dd63a3f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ffe31acb3b77a30ae34d01719a269881569fb7f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/beab10429439e20708036a66fb0d97ffb79da6a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e9fcca3e87463013d595c65c2189ffaa32ad3b50"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31757.json b/data/2026/CVE-2026-31757.json
index e5790c8dbd..078a3553c9 100644
--- a/data/2026/CVE-2026-31757.json
+++ b/data/2026/CVE-2026-31757.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/misc/usbio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"65ff09f48b0e72e4049096a989723406aabcf091","status":"affected","version":"121a0f839dbb397af5fabb701cea3e9983223e50","versionType":"git"},{"lessThan":"1762dc43b983d321180582afba4a0c5185fae04c","status":"affected","version":"121a0f839dbb397af5fabb701cea3e9983223e50","versionType":"git"},{"lessThan":"33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21","status":"affected","version":"121a0f839dbb397af5fabb701cea3e9983223e50","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/misc/usbio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BFDF75B5-A823-4448-88D3-3029C0464168","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: Fix URB memory leak on submit failure\n\nWhen usb_submit_urb() fails in usbio_probe(), the previously allocated\nURB is never freed, causing a memory leak.\n\nFix this by jumping to err_free_urb label to properly release the URB\non the error path."}],"id":"CVE-2026-31757","lastModified":"2026-06-17T10:34:24.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.700","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1762dc43b983d321180582afba4a0c5185fae04c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65ff09f48b0e72e4049096a989723406aabcf091"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/misc/usbio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"65ff09f48b0e72e4049096a989723406aabcf091","status":"affected","version":"121a0f839dbb397af5fabb701cea3e9983223e50","versionType":"git"},{"lessThan":"1762dc43b983d321180582afba4a0c5185fae04c","status":"affected","version":"121a0f839dbb397af5fabb701cea3e9983223e50","versionType":"git"},{"lessThan":"33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21","status":"affected","version":"121a0f839dbb397af5fabb701cea3e9983223e50","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/misc/usbio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BFDF75B5-A823-4448-88D3-3029C0464168","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: misc: usbio: Fix URB memory leak on submit failure\n\nWhen usb_submit_urb() fails in usbio_probe(), the previously allocated\nURB is never freed, causing a memory leak.\n\nFix this by jumping to err_free_urb label to properly release the URB\non the error path."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: misc: usbio: Corrección de fuga de memoria de URB al fallar el envío\n\nCuando usb_submit_urb() falla en usbio_probe(), el URB previamente asignado nunca se libera, causando una fuga de memoria.\n\nEsto se corrige saltando a la etiqueta err_free_urb para liberar correctamente el URB en la ruta de error."}],"id":"CVE-2026-31757","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:38.700","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1762dc43b983d321180582afba4a0c5185fae04c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33cfe0709b6bf1a7f1a16d5e8d65d003a71b6a21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65ff09f48b0e72e4049096a989723406aabcf091"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31758.json b/data/2026/CVE-2026-31758.json
index 9b1b012843..21883fca98 100644
--- a/data/2026/CVE-2026-31758.json
+++ b/data/2026/CVE-2026-31758.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/class/usbtmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"959ef329071136e4335b54822fe2f607659b4569","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"e189d443767f7cd390c52f2e122e1fc41c7562d6","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"95e09b07e50290254b28b8395509473104518f8c","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"977b632db51d231dec0bc571089a5c2402674139","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"d40198de50232e04c14c6e2092e896766c95ea48","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"8a768552f7a8276fb9e01d49773d2094ace7c8f1","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/class/usbtmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8DA957C-C958-43FF-BB9F-975A326709F9","versionEndExcluding":"5.10.253","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: Flush anchored URBs in usbtmc_release\n\nWhen calling usbtmc_release, pending anchored URBs must be flushed or\nkilled to prevent use-after-free errors (e.g. in the HCD giveback\npath). Call usbtmc_draw_down() to allow anchored URBs to be completed."}],"id":"CVE-2026-31758","lastModified":"2026-10-19T20:17:57.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31758","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:00.464457Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:38.807","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a768552f7a8276fb9e01d49773d2094ace7c8f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/959ef329071136e4335b54822fe2f607659b4569"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95e09b07e50290254b28b8395509473104518f8c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/977b632db51d231dec0bc571089a5c2402674139"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d40198de50232e04c14c6e2092e896766c95ea48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e189d443767f7cd390c52f2e122e1fc41c7562d6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/class/usbtmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"959ef329071136e4335b54822fe2f607659b4569","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"e189d443767f7cd390c52f2e122e1fc41c7562d6","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"95e09b07e50290254b28b8395509473104518f8c","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"977b632db51d231dec0bc571089a5c2402674139","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"d40198de50232e04c14c6e2092e896766c95ea48","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"},{"lessThan":"8a768552f7a8276fb9e01d49773d2094ace7c8f1","status":"affected","version":"4f3c8d6eddc272b386464524235440a418ed2029","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/class/usbtmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8DA957C-C958-43FF-BB9F-975A326709F9","versionEndExcluding":"5.10.253","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: Flush anchored URBs in usbtmc_release\n\nWhen calling usbtmc_release, pending anchored URBs must be flushed or\nkilled to prevent use-after-free errors (e.g. in the HCD giveback\npath). Call usbtmc_draw_down() to allow anchored URBs to be completed."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nusb: usbtmc: Vaciar URBs anclados en usbtmc_release\n\nAl llamar a usbtmc_release, los URBs anclados pendientes deben vaciarse o eliminarse para evitar errores de uso después de liberación (p. ej., en la ruta de devolución de HCD). Llamar a usbtmc_draw_down() para permitir que los URBs anclados se completen."}],"id":"CVE-2026-31758","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31758","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:00.464457Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:38.807","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a768552f7a8276fb9e01d49773d2094ace7c8f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/959ef329071136e4335b54822fe2f607659b4569"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95e09b07e50290254b28b8395509473104518f8c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/977b632db51d231dec0bc571089a5c2402674139"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d40198de50232e04c14c6e2092e896766c95ea48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e189d443767f7cd390c52f2e122e1fc41c7562d6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31759.json b/data/2026/CVE-2026-31759.json
index e79f9b73f3..75526cc5cb 100644
--- a/data/2026/CVE-2026-31759.json
+++ b/data/2026/CVE-2026-31759.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/common/ulpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2f70ba9dae13a190673cc3f9b4aad52179738f60","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"ee248e6e941e4f2e634df2bd43e5f1ef810ab6df","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"272a9b26c336a295e4e209157fed809706c1b1f7","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"aaeae6533d77e6ed4def85baec01e2815ebbef61","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"8763f8317bb389aded32a32b08f6751cfff657d2","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"38c28fe25611099230f0965c925499bfcf46a795","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"a6e5461f076c2ef63159f18e5cdbd30b50f0bc15","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"01af542392b5d41fd659d487015a71f627accce3","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/common/ulpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CC85AD7F-B910-43F1-9A7F-94BC2781DACB","versionEndExcluding":"5.10.253","versionStartIncluding":"4.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: fix double free in ulpi_register_interface() error path\n\nWhen device_register() fails, ulpi_register() calls put_device() on\nulpi->dev.\n\nThe device release callback ulpi_dev_release() drops the OF node\nreference and frees ulpi, but the current error path in\nulpi_register_interface() then calls kfree(ulpi) again, causing a\ndouble free.\n\nLet put_device() handle the cleanup through ulpi_dev_release() and\navoid freeing ulpi again in ulpi_register_interface()."}],"id":"CVE-2026-31759","lastModified":"2026-11-06T16:18:09.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:54.410524Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:38.923","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01af542392b5d41fd659d487015a71f627accce3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/272a9b26c336a295e4e209157fed809706c1b1f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f70ba9dae13a190673cc3f9b4aad52179738f60"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38c28fe25611099230f0965c925499bfcf46a795"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8763f8317bb389aded32a32b08f6751cfff657d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6e5461f076c2ef63159f18e5cdbd30b50f0bc15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aaeae6533d77e6ed4def85baec01e2815ebbef61"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee248e6e941e4f2e634df2bd43e5f1ef810ab6df"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/common/ulpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2f70ba9dae13a190673cc3f9b4aad52179738f60","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"ee248e6e941e4f2e634df2bd43e5f1ef810ab6df","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"272a9b26c336a295e4e209157fed809706c1b1f7","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"aaeae6533d77e6ed4def85baec01e2815ebbef61","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"8763f8317bb389aded32a32b08f6751cfff657d2","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"38c28fe25611099230f0965c925499bfcf46a795","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"a6e5461f076c2ef63159f18e5cdbd30b50f0bc15","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"},{"lessThan":"01af542392b5d41fd659d487015a71f627accce3","status":"affected","version":"289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/common/ulpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CC85AD7F-B910-43F1-9A7F-94BC2781DACB","versionEndExcluding":"5.10.253","versionStartIncluding":"4.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: ulpi: fix double free in ulpi_register_interface() error path\n\nWhen device_register() fails, ulpi_register() calls put_device() on\nulpi->dev.\n\nThe device release callback ulpi_dev_release() drops the OF node\nreference and frees ulpi, but the current error path in\nulpi_register_interface() then calls kfree(ulpi) again, causing a\ndouble free.\n\nLet put_device() handle the cleanup through ulpi_dev_release() and\navoid freeing ulpi again in ulpi_register_interface()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: ulpi: corregir doble liberación en la ruta de error de ulpi_register_interface()\n\nCuando device_register() falla, ulpi_register() llama a put_device() en ulpi  ->  dev.\n\nLa función de devolución de llamada de liberación de dispositivo ulpi_dev_release() elimina la referencia del nodo OF y libera ulpi, pero la ruta de error actual en ulpi_register_interface() luego llama a kfree(ulpi) de nuevo, causando una doble liberación.\n\nDejar que put_device() maneje la limpieza a través de ulpi_dev_release() y evitar liberar ulpi de nuevo en ulpi_register_interface()."}],"id":"CVE-2026-31759","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:54.410524Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:38.923","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01af542392b5d41fd659d487015a71f627accce3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/272a9b26c336a295e4e209157fed809706c1b1f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f70ba9dae13a190673cc3f9b4aad52179738f60"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38c28fe25611099230f0965c925499bfcf46a795"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8763f8317bb389aded32a32b08f6751cfff657d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6e5461f076c2ef63159f18e5cdbd30b50f0bc15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aaeae6533d77e6ed4def85baec01e2815ebbef61"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee248e6e941e4f2e634df2bd43e5f1ef810ab6df"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31760.json b/data/2026/CVE-2026-31760.json
index d6f8a2a06c..a5172949a0 100644
--- a/data/2026/CVE-2026-31760.json
+++ b/data/2026/CVE-2026-31760.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"21f942879f86108b300a23683e67483f8c358fc7","status":"affected","version":"fce79512a96afacbe297ba3c5c2f7ed34944540d","versionType":"git"},{"lessThan":"706f4fe2dacc95d65e7c8dff321711f024bb8d20","status":"affected","version":"fce79512a96afacbe297ba3c5c2f7ed34944540d","versionType":"git"},{"lessThan":"5cefb52c1af6f69ea719e42788f6ec6a087eb74c","status":"affected","version":"fce79512a96afacbe297ba3c5c2f7ed34944540d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpib: lpvo_usb: fix memory leak on disconnect\n\nThe driver iterates over the registered USB interfaces during GPIB\nattach and takes a reference to their USB devices until a match is\nfound. These references are never released which leads to a memory leak\nwhen devices are disconnected.\n\nFix the leak by dropping the unnecessary references."}],"id":"CVE-2026-31760","lastModified":"2026-06-17T10:34:24.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:39.047","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21f942879f86108b300a23683e67483f8c358fc7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5cefb52c1af6f69ea719e42788f6ec6a087eb74c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/706f4fe2dacc95d65e7c8dff321711f024bb8d20"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"21f942879f86108b300a23683e67483f8c358fc7","status":"affected","version":"fce79512a96afacbe297ba3c5c2f7ed34944540d","versionType":"git"},{"lessThan":"706f4fe2dacc95d65e7c8dff321711f024bb8d20","status":"affected","version":"fce79512a96afacbe297ba3c5c2f7ed34944540d","versionType":"git"},{"lessThan":"5cefb52c1af6f69ea719e42788f6ec6a087eb74c","status":"affected","version":"fce79512a96afacbe297ba3c5c2f7ed34944540d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpib/lpvo_usb_gpib/lpvo_usb_gpib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpib: lpvo_usb: fix memory leak on disconnect\n\nThe driver iterates over the registered USB interfaces during GPIB\nattach and takes a reference to their USB devices until a match is\nfound. These references are never released which leads to a memory leak\nwhen devices are disconnected.\n\nFix the leak by dropping the unnecessary references."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpib: lpvo_usb: corregir fuga de memoria al desconectar\n\nEl controlador itera sobre las interfaces USB registradas durante la conexión GPIB y toma una referencia a sus dispositivos USB hasta que se encuentra una coincidencia. Estas referencias nunca se liberan, lo que provoca una fuga de memoria cuando los dispositivos se desconectan.\n\nCorregir la fuga al eliminar las referencias innecesarias."}],"id":"CVE-2026-31760","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:39.047","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21f942879f86108b300a23683e67483f8c358fc7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5cefb52c1af6f69ea719e42788f6ec6a087eb74c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/706f4fe2dacc95d65e7c8dff321711f024bb8d20"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31761.json b/data/2026/CVE-2026-31761.json
index ac01d4666b..449386ffd7 100644
--- a/data/2026/CVE-2026-31761.json
+++ b/data/2026/CVE-2026-31761.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"22487ef85f6dd9499ddf49b85a08afc50a3f1992","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"caec338f91469f0a70b68165185afa3abc994545","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"051ca43b0e0e4b66bfd349cd53ccf231ad1d69b7","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"2a4537653d200fda2a8516083459f8ff6194f8fc","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"92f18aa86302fe83e0726a1191015f427d4ff056","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"cc3de12a5612ee25df7fb549cb7b3e4cc8bfaf9c","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"59a317f8215674c8330817770497301bfb2c1b99","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"4c05799449108fb0e0a6bd30e65fffc71e60db4d","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6295619F-1E94-4D58-A683-135EACD0504E","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Move iio_device_register() to correct location\n\niio_device_register() should be at the end of the probe function to\nprevent race conditions.\n\nPlace iio_device_register() at the end of the probe function and place\niio_device_unregister() accordingly."}],"id":"CVE-2026-31761","lastModified":"2026-11-10T13:19:04.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:39.153","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/051ca43b0e0e4b66bfd349cd53ccf231ad1d69b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22487ef85f6dd9499ddf49b85a08afc50a3f1992"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a4537653d200fda2a8516083459f8ff6194f8fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c05799449108fb0e0a6bd30e65fffc71e60db4d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59a317f8215674c8330817770497301bfb2c1b99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92f18aa86302fe83e0726a1191015f427d4ff056"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/caec338f91469f0a70b68165185afa3abc994545"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc3de12a5612ee25df7fb549cb7b3e4cc8bfaf9c"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"22487ef85f6dd9499ddf49b85a08afc50a3f1992","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"caec338f91469f0a70b68165185afa3abc994545","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"051ca43b0e0e4b66bfd349cd53ccf231ad1d69b7","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"2a4537653d200fda2a8516083459f8ff6194f8fc","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"92f18aa86302fe83e0726a1191015f427d4ff056","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"cc3de12a5612ee25df7fb549cb7b3e4cc8bfaf9c","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"59a317f8215674c8330817770497301bfb2c1b99","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"4c05799449108fb0e0a6bd30e65fffc71e60db4d","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6295619F-1E94-4D58-A683-135EACD0504E","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Move iio_device_register() to correct location\n\niio_device_register() should be at the end of the probe function to\nprevent race conditions.\n\nPlace iio_device_register() at the end of the probe function and place\niio_device_unregister() accordingly."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: gyro: mpu3050: Mover iio_device_register() a la ubicación correcta\n\niio_device_register() debería estar al final de la función de sondeo para evitar condiciones de carrera.\n\nColocar iio_device_register() al final de la función de sondeo y colocar iio_device_unregister() en consecuencia."}],"id":"CVE-2026-31761","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:39.153","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/051ca43b0e0e4b66bfd349cd53ccf231ad1d69b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22487ef85f6dd9499ddf49b85a08afc50a3f1992"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a4537653d200fda2a8516083459f8ff6194f8fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c05799449108fb0e0a6bd30e65fffc71e60db4d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59a317f8215674c8330817770497301bfb2c1b99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92f18aa86302fe83e0726a1191015f427d4ff056"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/caec338f91469f0a70b68165185afa3abc994545"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc3de12a5612ee25df7fb549cb7b3e4cc8bfaf9c"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31762.json b/data/2026/CVE-2026-31762.json
index 2d6375a9de..b724a65193 100644
--- a/data/2026/CVE-2026-31762.json
+++ b/data/2026/CVE-2026-31762.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"beb23092571e627190f23da4bb8548065cacd89c","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"658d9deb45d5032baf388ac51991d1e789157334","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"889253494ec73d60bd47c0518f8fe3a748520d5b","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"8f237c408f3007d7d9667623ffb41a9e9d661ee9","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"b52fd1644ad2c4e96bbec97543a966d7ad8f21ea","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"3a8e68d65a443de05061818823037931674740e0","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"e66215fc1878357d5c980066e650f542330524af","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"4216db1043a3be72ef9c2b7b9f393d7fa72496e6","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6295619F-1E94-4D58-A683-135EACD0504E","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Fix irq resource leak\n\nThe interrupt handler is setup but only a few lines down if\niio_trigger_register() fails the function returns without properly\nreleasing the handler.\n\nAdd cleanup goto to resolve resource leak.\n\nDetected by Smatch:\ndrivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:\n'irq' from request_threaded_irq() not released on lines: 1124."}],"id":"CVE-2026-31762","lastModified":"2026-06-17T10:34:25.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:39.277","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a8e68d65a443de05061818823037931674740e0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4216db1043a3be72ef9c2b7b9f393d7fa72496e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/658d9deb45d5032baf388ac51991d1e789157334"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/889253494ec73d60bd47c0518f8fe3a748520d5b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f237c408f3007d7d9667623ffb41a9e9d661ee9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b52fd1644ad2c4e96bbec97543a966d7ad8f21ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/beb23092571e627190f23da4bb8548065cacd89c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e66215fc1878357d5c980066e650f542330524af"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"beb23092571e627190f23da4bb8548065cacd89c","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"658d9deb45d5032baf388ac51991d1e789157334","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"889253494ec73d60bd47c0518f8fe3a748520d5b","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"8f237c408f3007d7d9667623ffb41a9e9d661ee9","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"b52fd1644ad2c4e96bbec97543a966d7ad8f21ea","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"3a8e68d65a443de05061818823037931674740e0","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"e66215fc1878357d5c980066e650f542330524af","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"4216db1043a3be72ef9c2b7b9f393d7fa72496e6","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6295619F-1E94-4D58-A683-135EACD0504E","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Fix irq resource leak\n\nThe interrupt handler is setup but only a few lines down if\niio_trigger_register() fails the function returns without properly\nreleasing the handler.\n\nAdd cleanup goto to resolve resource leak.\n\nDetected by Smatch:\ndrivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:\n'irq' from request_threaded_irq() not released on lines: 1124."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: gyro: mpu3050: Corrección de fuga de recursos IRQ\n\nEl gestor de interrupciones se configura, pero solo unas pocas líneas más abajo, si iio_trigger_register() falla, la función retorna sin liberar correctamente el gestor.\n\nAñadir un ’goto’ de limpieza para resolver la fuga de recursos.\n\nDetectado por Smatch:\ndrivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() advertencia: ’irq’ de request_threaded_irq() no liberado en las líneas: 1124."}],"id":"CVE-2026-31762","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:39.277","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a8e68d65a443de05061818823037931674740e0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4216db1043a3be72ef9c2b7b9f393d7fa72496e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/658d9deb45d5032baf388ac51991d1e789157334"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/889253494ec73d60bd47c0518f8fe3a748520d5b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f237c408f3007d7d9667623ffb41a9e9d661ee9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b52fd1644ad2c4e96bbec97543a966d7ad8f21ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/beb23092571e627190f23da4bb8548065cacd89c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e66215fc1878357d5c980066e650f542330524af"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31763.json b/data/2026/CVE-2026-31763.json
index 82c6e6295e..9142a846fb 100644
--- a/data/2026/CVE-2026-31763.json
+++ b/data/2026/CVE-2026-31763.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"11f7cd960f05b3f06747abfdc4e56dd0d8b8a157","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"fdbe4b5268cd41f9953d25a67d139e47cac34519","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"8001b42fbd5e510dced3a25665019982c99bc708","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"a09171d3f23e13bccd3dc34863186707c6301071","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"8631e755fc07b651b5d158cc3656ef76cc874068","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"ac1233397f4cfe55d71f6aa459b42c256c951531","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"2821f7b62c5b3633c4923c7e4f742380897cd511","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6295619F-1E94-4D58-A683-135EACD0504E","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Fix incorrect free_irq() variable\n\nThe handler for the IRQ part of this driver is mpu3050->trig but,\nin the teardown free_irq() is called with handler mpu3050.\n\nUse correct IRQ handler when calling free_irq()."}],"id":"CVE-2026-31763","lastModified":"2026-06-17T10:34:25.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:39.400","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11f7cd960f05b3f06747abfdc4e56dd0d8b8a157"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2821f7b62c5b3633c4923c7e4f742380897cd511"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8001b42fbd5e510dced3a25665019982c99bc708"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8631e755fc07b651b5d158cc3656ef76cc874068"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a09171d3f23e13bccd3dc34863186707c6301071"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac1233397f4cfe55d71f6aa459b42c256c951531"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fdbe4b5268cd41f9953d25a67d139e47cac34519"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"11f7cd960f05b3f06747abfdc4e56dd0d8b8a157","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"fdbe4b5268cd41f9953d25a67d139e47cac34519","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"8001b42fbd5e510dced3a25665019982c99bc708","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"a09171d3f23e13bccd3dc34863186707c6301071","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"8631e755fc07b651b5d158cc3656ef76cc874068","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"ac1233397f4cfe55d71f6aa459b42c256c951531","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"2821f7b62c5b3633c4923c7e4f742380897cd511","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"},{"lessThan":"edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6","status":"affected","version":"3904b28efb2c780c23dcddfb87e07fe0230661e5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/gyro/mpu3050-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6295619F-1E94-4D58-A683-135EACD0504E","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Fix incorrect free_irq() variable\n\nThe handler for the IRQ part of this driver is mpu3050->trig but,\nin the teardown free_irq() is called with handler mpu3050.\n\nUse correct IRQ handler when calling free_irq()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: gyro: mpu3050: Solución para la variable free_irq() incorrecta\n\nEl gestor para la parte IRQ de este controlador es mpu3050  ->  trig pero, en el desmontaje, se llama a free_irq() con el gestor mpu3050.\n\nUsar el gestor IRQ correcto al llamar a free_irq()."}],"id":"CVE-2026-31763","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:39.400","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11f7cd960f05b3f06747abfdc4e56dd0d8b8a157"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2821f7b62c5b3633c4923c7e4f742380897cd511"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8001b42fbd5e510dced3a25665019982c99bc708"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8631e755fc07b651b5d158cc3656ef76cc874068"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a09171d3f23e13bccd3dc34863186707c6301071"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac1233397f4cfe55d71f6aa459b42c256c951531"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fdbe4b5268cd41f9953d25a67d139e47cac34519"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31764.json b/data/2026/CVE-2026-31764.json
index 1e613d2fb5..71fa901cd9 100644
--- a/data/2026/CVE-2026-31764.json
+++ b/data/2026/CVE-2026-31764.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3225a81e8d264442b14c7c1bc965ebafa3c0ee01","status":"affected","version":"6b648a36c200dfd3e776e657a4c8a8ce63fb52d3","versionType":"git"},{"lessThan":"679c04c10d65d32a3f269e696b22912ff0a001b9","status":"affected","version":"6b648a36c200dfd3e776e657a4c8a8ce63fb52d3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only\n\nThe st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace\nwrites the buffer sampling frequency sysfs attribute, calls\nst_lsm6dsx_check_odr(), which accesses the odr_table array at index\n`sensor->id`; since this array is only 2 entries long, an access for any\nsensor type other than accelerometer or gyroscope is an out-of-bounds\naccess.\n\nThe motivation for being able to set a buffer frequency different from the\nsensor sampling frequency is to support use cases that need accurate event\ndetection (which requires a high sampling frequency) while retrieving\nsensor data at low frequency. Since all the supported event types are\ngenerated from acceleration data only, do not create the buffer sampling\nfrequency attribute for sensor types other than the accelerometer."}],"id":"CVE-2026-31764","lastModified":"2026-06-17T10:34:25.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:39.523","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3225a81e8d264442b14c7c1bc965ebafa3c0ee01"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/679c04c10d65d32a3f269e696b22912ff0a001b9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3225a81e8d264442b14c7c1bc965ebafa3c0ee01","status":"affected","version":"6b648a36c200dfd3e776e657a4c8a8ce63fb52d3","versionType":"git"},{"lessThan":"679c04c10d65d32a3f269e696b22912ff0a001b9","status":"affected","version":"6b648a36c200dfd3e776e657a4c8a8ce63fb52d3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: st_lsm6dsx: Set buffer sampling frequency for accelerometer only\n\nThe st_lsm6dsx_hwfifo_odr_store() function, which is called when userspace\nwrites the buffer sampling frequency sysfs attribute, calls\nst_lsm6dsx_check_odr(), which accesses the odr_table array at index\n`sensor->id`; since this array is only 2 entries long, an access for any\nsensor type other than accelerometer or gyroscope is an out-of-bounds\naccess.\n\nThe motivation for being able to set a buffer frequency different from the\nsensor sampling frequency is to support use cases that need accurate event\ndetection (which requires a high sampling frequency) while retrieving\nsensor data at low frequency. Since all the supported event types are\ngenerated from acceleration data only, do not create the buffer sampling\nfrequency attribute for sensor types other than the accelerometer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: imu: st_lsm6dsx: Establecer la frecuencia de muestreo del búfer solo para el acelerómetro\n\nLa función st_lsm6dsx_hwfifo_odr_store(), que se llama cuando el espacio de usuario (userspace) escribe el atributo sysfs de frecuencia de muestreo del búfer, llama a st_lsm6dsx_check_odr(), que accede al array odr_table en el índice ’sensor  ->  id’; dado que este array tiene solo 2 entradas de longitud, un acceso para cualquier tipo de sensor que no sea acelerómetro o giroscopio es un acceso fuera de límites.\n\nLa motivación para poder establecer una frecuencia de búfer diferente de la frecuencia de muestreo del sensor es para soportar casos de uso que necesitan detección precisa de eventos (lo que requiere una alta frecuencia de muestreo) mientras se recuperan datos del sensor a baja frecuencia. Dado que todos los tipos de eventos soportados se generan solo a partir de datos de aceleración, no cree el atributo de frecuencia de muestreo del búfer para tipos de sensor que no sean el acelerómetro."}],"id":"CVE-2026-31764","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:39.523","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3225a81e8d264442b14c7c1bc965ebafa3c0ee01"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/679c04c10d65d32a3f269e696b22912ff0a001b9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31765.json b/data/2026/CVE-2026-31765.json
index 838d55a733..4f25e7d6b9 100644
--- a/data/2026/CVE-2026-31765.json
+++ b/data/2026/CVE-2026-31765.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h","drivers/gpu/drm/amd/amdkfd/kfd_priv.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6b2614a0ff05a2d2836311425091c8feca6f0c21","status":"affected","version":"34a1de0f79352086884553f78db271f957a98583","versionType":"git"},{"lessThan":"77c918eaa4c916751769242567407f61c6af142a","status":"affected","version":"34a1de0f79352086884553f78db271f957a98583","versionType":"git"},{"lessThan":"d3508cf822c4d96d3e492210314f8f6f2da7df58","status":"affected","version":"34a1de0f79352086884553f78db271f957a98583","versionType":"git"},{"lessThan":"4487571ef17a30d274600b3bd6965f497a881299","status":"affected","version":"34a1de0f79352086884553f78db271f957a98583","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h","drivers/gpu/drm/amd/amdkfd/kfd_priv.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6276F46A-4462-4160-9890-B059A6D60C74","versionEndExcluding":"6.12.81","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB\n\nCurrently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while\nKFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with\n4K pages, both values match (8KB), so allocation and reserved space\nare consistent.\n\nHowever, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB,\nwhile the reserved trap area remains 8KB. This mismatch causes the\nkernel to crash when running rocminfo or rccl unit tests.\n\nKernel attempted to read user page (2) - exploit attempt? (uid: 1001)\nBUG: Kernel NULL pointer dereference on read at 0x00000002\nFaulting instruction address: 0xc0000000002c8a64\nOops: Kernel access of bad area, sig: 11 [#1]\nLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\nCPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E\n6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY\nTainted: [E]=UNSIGNED_MODULE\nHardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006\nof:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries\nNIP:  c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730\nREGS: c0000001e0957580 TRAP: 0300 Tainted: G E\nMSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24008268\nXER: 00000036\nCFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000\nIRQMASK: 1\nGPR00: c00000000125d908 c0000001e0957820 c0000000016e8100\nc00000013d814540\nGPR04: 0000000000000002 c00000013d814550 0000000000000045\n0000000000000000\nGPR08: c00000013444d000 c00000013d814538 c00000013d814538\n0000000084002268\nGPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff\n0000000000020000\nGPR16: 0000000000000000 0000000000000002 c00000015f653000\n0000000000000000\nGPR20: c000000138662400 c00000013d814540 0000000000000000\nc00000013d814500\nGPR24: 0000000000000000 0000000000000002 c0000001e0957888\nc0000001e0957878\nGPR28: c00000013d814548 0000000000000000 c00000013d814540\nc0000001e0957888\nNIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0\nLR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00\nCall Trace:\n0xc0000001e0957890 (unreliable)\n__mutex_lock.constprop.0+0x58/0xd00\namdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu]\nkfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu]\nkfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu]\nkfd_process_device_init_vm+0xd8/0x2e0 [amdgpu]\nkfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu]\nkfd_ioctl+0x514/0x670 [amdgpu]\nsys_ioctl+0x134/0x180\nsystem_call_exception+0x114/0x300\nsystem_call_vectored_common+0x15c/0x2ec\n\nThis patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and\nKFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve\n64 KB for the trap in the address space, but only allocate 8 KB within\nit. With this approach, the allocation size never exceeds the reserved\narea.\n\n(cherry picked from commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb)"}],"id":"CVE-2026-31765","lastModified":"2026-11-06T16:18:09.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:59.201145Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:39.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4487571ef17a30d274600b3bd6965f497a881299"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6b2614a0ff05a2d2836311425091c8feca6f0c21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77c918eaa4c916751769242567407f61c6af142a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3508cf822c4d96d3e492210314f8f6f2da7df58"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h","drivers/gpu/drm/amd/amdkfd/kfd_priv.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6b2614a0ff05a2d2836311425091c8feca6f0c21","status":"affected","version":"34a1de0f79352086884553f78db271f957a98583","versionType":"git"},{"lessThan":"77c918eaa4c916751769242567407f61c6af142a","status":"affected","version":"34a1de0f79352086884553f78db271f957a98583","versionType":"git"},{"lessThan":"d3508cf822c4d96d3e492210314f8f6f2da7df58","status":"affected","version":"34a1de0f79352086884553f78db271f957a98583","versionType":"git"},{"lessThan":"4487571ef17a30d274600b3bd6965f497a881299","status":"affected","version":"34a1de0f79352086884553f78db271f957a98583","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h","drivers/gpu/drm/amd/amdkfd/kfd_priv.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6276F46A-4462-4160-9890-B059A6D60C74","versionEndExcluding":"6.12.81","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB\n\nCurrently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while\nKFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with\n4K pages, both values match (8KB), so allocation and reserved space\nare consistent.\n\nHowever, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB,\nwhile the reserved trap area remains 8KB. This mismatch causes the\nkernel to crash when running rocminfo or rccl unit tests.\n\nKernel attempted to read user page (2) - exploit attempt? (uid: 1001)\nBUG: Kernel NULL pointer dereference on read at 0x00000002\nFaulting instruction address: 0xc0000000002c8a64\nOops: Kernel access of bad area, sig: 11 [#1]\nLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\nCPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E\n6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY\nTainted: [E]=UNSIGNED_MODULE\nHardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006\nof:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries\nNIP:  c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730\nREGS: c0000001e0957580 TRAP: 0300 Tainted: G E\nMSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24008268\nXER: 00000036\nCFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000\nIRQMASK: 1\nGPR00: c00000000125d908 c0000001e0957820 c0000000016e8100\nc00000013d814540\nGPR04: 0000000000000002 c00000013d814550 0000000000000045\n0000000000000000\nGPR08: c00000013444d000 c00000013d814538 c00000013d814538\n0000000084002268\nGPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff\n0000000000020000\nGPR16: 0000000000000000 0000000000000002 c00000015f653000\n0000000000000000\nGPR20: c000000138662400 c00000013d814540 0000000000000000\nc00000013d814500\nGPR24: 0000000000000000 0000000000000002 c0000001e0957888\nc0000001e0957878\nGPR28: c00000013d814548 0000000000000000 c00000013d814540\nc0000001e0957888\nNIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0\nLR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00\nCall Trace:\n0xc0000001e0957890 (unreliable)\n__mutex_lock.constprop.0+0x58/0xd00\namdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu]\nkfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu]\nkfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu]\nkfd_process_device_init_vm+0xd8/0x2e0 [amdgpu]\nkfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu]\nkfd_ioctl+0x514/0x670 [amdgpu]\nsys_ioctl+0x134/0x180\nsystem_call_exception+0x114/0x300\nsystem_call_vectored_common+0x15c/0x2ec\n\nThis patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and\nKFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve\n64 KB for the trap in the address space, but only allocate 8 KB within\nit. With this approach, the allocation size never exceeds the reserved\narea.\n\n(cherry picked from commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu: Cambiar AMDGPU_VA_RESERVED_TRAP_SIZE a 64KB\n\nActualmente, AMDGPU_VA_RESERVED_TRAP_SIZE está codificado a 8KB, mientras que KFD_CWSR_TBA_TMA_SIZE se define como 2 * PAGE_SIZE. En sistemas con páginas de 4K, ambos valores coinciden (8KB), por lo que la asignación y el espacio reservado son consistentes.\n\nSin embargo, en sistemas con tamaño de página de 64K, KFD_CWSR_TBA_TMA_SIZE se convierte en 128KB, mientras que el área de trampa reservada permanece en 8KB. Esta inconsistencia causa que el kernel falle al ejecutar las pruebas unitarias de rocminfo o rccl.\n\nEl kernel intentó leer la página de usuario (2) - ¿intento de exploit? (uid: 1001)\nBUG: Desreferencia de puntero NULL del kernel en lectura en 0x 00000002\nDirección de instrucción con fallo: 0x c0000000002c8a64\nOops: Acceso del kernel a área incorrecta, sig: 11 [#1]\nLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\nCPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E\n6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY\nTainted: [E]=UNSIGNED_MODULE\nHardware name: IBM,9105-42A POWER10 (architected) 0x 800200 0x f000006\nof:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries\nNIP: c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730\nREGS: c0000001e0957580 TRAP: 0300 Tainted: G E\nMSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24008268\nXER: 00000036\nCFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000\nIRQMASK: 1\nGPR00: c00000000125d908 c0000001e0957820 c0000000016e8100\nc00000013d814540\nGPR04: 0000000000000002 c00000013d814550 0000000000000045\n0000000000000000\nGPR08: c00000013444d000 c00000013d814538 c00000013d814538\n0000000084002268\nGPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff\n0000000000020000\nGPR16: 0000000000000000 0000000000000002 c00000015f653000\n0000000000000000\nGPR20: c000000138662400 c00000013d814540 0000000000000000\nc00000013d814500\nGPR24: 0000000000000000 0000000000000002 c0000001e0957888\nc0000001e0957878\nGPR28: c00000013d814548 0000000000000000 c00000013d814540\nc0000001e0957888\nNIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0\nLR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00\nTraza de llamada:\n0x c0000001e0957890 (no fiable)\n__mutex_lock.constprop.0+0x58/0xd00\namdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu]\nkfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu]\nkfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu]\nkfd_process_device_init_vm+0xd8/0x2e0 [amdgpu]\nkfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu]\nkfd_ioctl+0x514/0x670 [amdgpu]\nsys_ioctl+0x134/0x180\nsystem_call_exception+0x114/0x300\nsystem_call_vectored_common+0x15c/0x2ec\n\nEste parche cambia AMDGPU_VA_RESERVED_TRAP_SIZE a 64 KB y KFD_CWSR_TBA_TMA_SIZE al tamaño de página de la GPU de AMD. Esto significa que reservamos 64 KB para la trampa en el espacio de direcciones, pero solo asignamos 8 KB dentro de él. Con este enfoque, el tamaño de la asignación nunca excede el área reservada.\n\n(seleccionado de la confirmación 31b8de5e55666f26ea7ece5f412b83eab3f56dbb)"}],"id":"CVE-2026-31765","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31765","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:59.201145Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:39.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4487571ef17a30d274600b3bd6965f497a881299"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6b2614a0ff05a2d2836311425091c8feca6f0c21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77c918eaa4c916751769242567407f61c6af142a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3508cf822c4d96d3e492210314f8f6f2da7df58"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31766.json b/data/2026/CVE-2026-31766.json
index bc218a6301..10e110a900 100644
--- a/data/2026/CVE-2026-31766.json
+++ b/data/2026/CVE-2026-31766.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3543005a42d7e8e12b21897ef6798541bf7cbcd3","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"},{"lessThan":"86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"},{"lessThan":"a018d1819f158991b7308e4f74609c6c029b670c","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B376ADEA-99DD-4C34-B0B2-7362FBE63A29","versionEndExcluding":"6.18.22","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate doorbell_offset in user queue creation\n\namdgpu_userq_get_doorbell_index() passes the user-provided\ndoorbell_offset to amdgpu_doorbell_index_on_bar() without bounds\nchecking. An arbitrarily large doorbell_offset can cause the\ncalculated doorbell index to fall outside the allocated doorbell BO,\npotentially corrupting kernel doorbell space.\n\nValidate that doorbell_offset falls within the doorbell BO before\ncomputing the BAR index, using u64 arithmetic to prevent overflow.\n\n(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)"}],"id":"CVE-2026-31766","lastModified":"2026-06-17T10:34:25.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:39.763","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3543005a42d7e8e12b21897ef6798541bf7cbcd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a018d1819f158991b7308e4f74609c6c029b670c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3543005a42d7e8e12b21897ef6798541bf7cbcd3","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"},{"lessThan":"86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"},{"lessThan":"a018d1819f158991b7308e4f74609c6c029b670c","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B376ADEA-99DD-4C34-B0B2-7362FBE63A29","versionEndExcluding":"6.18.22","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate doorbell_offset in user queue creation\n\namdgpu_userq_get_doorbell_index() passes the user-provided\ndoorbell_offset to amdgpu_doorbell_index_on_bar() without bounds\nchecking. An arbitrarily large doorbell_offset can cause the\ncalculated doorbell index to fall outside the allocated doorbell BO,\npotentially corrupting kernel doorbell space.\n\nValidate that doorbell_offset falls within the doorbell BO before\ncomputing the BAR index, using u64 arithmetic to prevent overflow.\n\n(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu: validar doorbell_offset en la creación de colas de usuario\n\namdgpu_userq_get_doorbell_index() pasa el doorbell_offset proporcionado por el usuario a amdgpu_doorbell_index_on_bar() sin comprobación de límites. Un doorbell_offset arbitrariamente grande puede causar que el índice de doorbell calculado caiga fuera del BO de doorbell asignado, corrompiendo potencialmente el espacio de doorbell del kernel.\n\nValidar que doorbell_offset caiga dentro del BO de doorbell antes de calcular el índice BAR, usando aritmética u64 para prevenir desbordamiento.\n\n(seleccionado de la confirmación de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)"}],"id":"CVE-2026-31766","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:39.763","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3543005a42d7e8e12b21897ef6798541bf7cbcd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a018d1819f158991b7308e4f74609c6c029b670c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31767.json b/data/2026/CVE-2026-31767.json
index 3d1a3e6b3a..0ba8ada771 100644
--- a/data/2026/CVE-2026-31767.json
+++ b/data/2026/CVE-2026-31767.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/display/icl_dsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"80cc84bdc49addaee6b6e4f735f574ab5a424c42","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"481f7a463ae4bea9503ae7fa1481ad75dc872af4","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"55efe8402f46af8399c8b634a18b130a05fd7820","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"86e926b108880c0109b8635e459450447156aeb7","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"33b5336e4fd8ba0e40a12989cadb3f5534a0f9e4","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"4dfce79e098915d8e5fc2b9e1d980bc3251dd32c","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/display/icl_dsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.6"},{"lessThan":"5.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D7C26F95-0187-4B01-A110-0643650CED29","versionEndExcluding":"6.12.81","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode\n\nStop adjusting the horizontal timing values based on the\ncompression ratio in command mode. Bspec seems to be telling\nus to do this only in video mode, and this is also how the\nWindows driver does things.\n\nThis should also fix a div-by-zero on some machines because\nthe adjusted htotal ends up being so small that we end up with\nline_time_us==0 when trying to determine the vtotal value in\ncommand mode.\n\nNote that this doesn't actually make the display on the\nHuawei Matebook E work, but at least the kernel no longer\nexplodes when the driver loads.\n\n(cherry picked from commit 0b475e91ecc2313207196c6d7fd5c53e1a878525)"}],"id":"CVE-2026-31767","lastModified":"2026-11-06T16:18:09.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:07.306539Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:39.870","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33b5336e4fd8ba0e40a12989cadb3f5534a0f9e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/481f7a463ae4bea9503ae7fa1481ad75dc872af4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4dfce79e098915d8e5fc2b9e1d980bc3251dd32c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/55efe8402f46af8399c8b634a18b130a05fd7820"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/80cc84bdc49addaee6b6e4f735f574ab5a424c42"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86e926b108880c0109b8635e459450447156aeb7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/display/icl_dsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"80cc84bdc49addaee6b6e4f735f574ab5a424c42","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"481f7a463ae4bea9503ae7fa1481ad75dc872af4","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"55efe8402f46af8399c8b634a18b130a05fd7820","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"86e926b108880c0109b8635e459450447156aeb7","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"33b5336e4fd8ba0e40a12989cadb3f5534a0f9e4","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"},{"lessThan":"4dfce79e098915d8e5fc2b9e1d980bc3251dd32c","status":"affected","version":"53693f02d80e0a909e76c2a25f8aac8515f959db","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/display/icl_dsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.6"},{"lessThan":"5.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D7C26F95-0187-4B01-A110-0643650CED29","versionEndExcluding":"6.12.81","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode\n\nStop adjusting the horizontal timing values based on the\ncompression ratio in command mode. Bspec seems to be telling\nus to do this only in video mode, and this is also how the\nWindows driver does things.\n\nThis should also fix a div-by-zero on some machines because\nthe adjusted htotal ends up being so small that we end up with\nline_time_us==0 when trying to determine the vtotal value in\ncommand mode.\n\nNote that this doesn't actually make the display on the\nHuawei Matebook E work, but at least the kernel no longer\nexplodes when the driver loads.\n\n(cherry picked from commit 0b475e91ecc2313207196c6d7fd5c53e1a878525)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/i915/dsi: No realizar ajustes de temporización horizontal DSC en modo comando\n\nDejar de ajustar los valores de temporización horizontal basándose en la relación de compresión en modo comando. Bspec parece indicarnos que hagamos esto solo en modo video, y así es también como el controlador de Windows hace las cosas.\n\nEsto también debería solucionar una división por cero en algunas máquinas porque el htotal ajustado termina siendo tan pequeño que terminamos con line_time_us==0 al intentar determinar el valor de vtotal en modo comando.\n\nTenga en cuenta que esto en realidad no hace que la pantalla del Huawei Matebook E funcione, pero al menos el kernel ya no explota cuando el controlador se carga.\n\n(seleccionado de la confirmación 0b475e91ecc2313207196c6d7fd5c53e1a878525)"}],"id":"CVE-2026-31767","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31767","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:07.306539Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:39.870","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33b5336e4fd8ba0e40a12989cadb3f5534a0f9e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/481f7a463ae4bea9503ae7fa1481ad75dc872af4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4dfce79e098915d8e5fc2b9e1d980bc3251dd32c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/55efe8402f46af8399c8b634a18b130a05fd7820"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/80cc84bdc49addaee6b6e4f735f574ab5a424c42"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86e926b108880c0109b8635e459450447156aeb7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31768.json b/data/2026/CVE-2026-31768.json
index 635d3397f2..7038a91acd 100644
--- a/data/2026/CVE-2026-31768.json
+++ b/data/2026/CVE-2026-31768.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/adc/ti-adc161s626.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b3bb8faeca1a2ef7be95ee8a512b639f9ffce947","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"fa64aab25aba47296aa8d12bb4c88ec3fecb2054","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"67b3a91bdc48220bfb67155ab528121b9c822782","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"014c6d27878d3883f7bb065610768fd021de1a96","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"d2d031b0786ea66ab0577c9d2d71435068d32199","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"768461517a28d80fe81ea4d5d03a90cd184ea6ad","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/adc/ti-adc161s626.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"398FB001-08FB-43B5-927C-EF197FB74E3E","versionEndExcluding":"6.1.168","versionStartIncluding":"4.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ti-adc161s626: use DMA-safe memory for spi_read()\n\nAdd a DMA-safe buffer and use it for spi_read() instead of a stack\nmemory. All SPI buffers must be DMA-safe.\n\nSince we only need up to 3 bytes, we just use a u8[] instead of __be16\nand __be32 and change the conversion functions appropriately."}],"id":"CVE-2026-31768","lastModified":"2026-11-10T13:19:04.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:39.977","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/014c6d27878d3883f7bb065610768fd021de1a96"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67b3a91bdc48220bfb67155ab528121b9c822782"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/768461517a28d80fe81ea4d5d03a90cd184ea6ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b3bb8faeca1a2ef7be95ee8a512b639f9ffce947"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2d031b0786ea66ab0577c9d2d71435068d32199"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa64aab25aba47296aa8d12bb4c88ec3fecb2054"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iio/adc/ti-adc161s626.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b3bb8faeca1a2ef7be95ee8a512b639f9ffce947","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"fa64aab25aba47296aa8d12bb4c88ec3fecb2054","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"67b3a91bdc48220bfb67155ab528121b9c822782","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"014c6d27878d3883f7bb065610768fd021de1a96","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"d2d031b0786ea66ab0577c9d2d71435068d32199","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"},{"lessThan":"768461517a28d80fe81ea4d5d03a90cd184ea6ad","status":"affected","version":"4d671b71beefbfc145b971a11e0c3cabde94b673","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iio/adc/ti-adc161s626.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"398FB001-08FB-43B5-927C-EF197FB74E3E","versionEndExcluding":"6.1.168","versionStartIncluding":"4.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ti-adc161s626: use DMA-safe memory for spi_read()\n\nAdd a DMA-safe buffer and use it for spi_read() instead of a stack\nmemory. All SPI buffers must be DMA-safe.\n\nSince we only need up to 3 bytes, we just use a u8[] instead of __be16\nand __be32 and change the conversion functions appropriately."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: adc: ti-adc161s626: usar memoria segura para DMA para spi_read()\n\nAñadir un búfer seguro para DMA y usarlo para spi_read() en lugar de una memoria de pila. Todos los búferes SPI deben ser seguros para DMA.\n\nDado que solo necesitamos hasta 3 bytes, simplemente usamos un u8[] en lugar de __be16 y __be32 y cambiamos las funciones de conversión apropiadamente."}],"id":"CVE-2026-31768","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:39.977","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/014c6d27878d3883f7bb065610768fd021de1a96"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67b3a91bdc48220bfb67155ab528121b9c822782"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/768461517a28d80fe81ea4d5d03a90cd184ea6ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b3bb8faeca1a2ef7be95ee8a512b639f9ffce947"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2d031b0786ea66ab0577c9d2d71435068d32199"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa64aab25aba47296aa8d12bb4c88ec3fecb2054"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31769.json b/data/2026/CVE-2026-31769.json
index d2acff44b1..ef60d38625 100644
--- a/data/2026/CVE-2026-31769.json
+++ b/data/2026/CVE-2026-31769.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpib/common/gpib_os.c","drivers/gpib/include/gpib_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c","status":"affected","version":"9dde4559e93955ccc47d588f7fd051684d55c4e7","versionType":"git"},{"lessThan":"28c75dd143ead62e0dfac564c79d251e21d5d74b","status":"affected","version":"9dde4559e93955ccc47d588f7fd051684d55c4e7","versionType":"git"},{"lessThan":"d1857f8296dceb75d00ab857fc3c61bc00c7f5c6","status":"affected","version":"9dde4559e93955ccc47d588f7fd051684d55c4e7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpib/common/gpib_os.c","drivers/gpib/include/gpib_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpib: fix use-after-free in IO ioctl handlers\n\nThe IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers use a gpib_descriptor\npointer after board->big_gpib_mutex has been released.  A concurrent\nIBCLOSEDEV ioctl can free the descriptor via close_dev_ioctl() during\nthis window, causing a use-after-free.\n\nThe IO handlers (read_ioctl, write_ioctl, command_ioctl) explicitly\nrelease big_gpib_mutex before calling their handler.  wait_ioctl() is\ncalled with big_gpib_mutex held, but ibwait() releases it internally\nwhen wait_mask is non-zero.  In all four cases, the descriptor pointer\nobtained from handle_to_descriptor() becomes unprotected.\n\nFix this by introducing a kernel-only descriptor_busy reference count\nin struct gpib_descriptor.  Each handler atomically increments\ndescriptor_busy under file_priv->descriptors_mutex before releasing the\nlock, and decrements it when done.  close_dev_ioctl() checks\ndescriptor_busy under the same lock and rejects the close with -EBUSY\nif the count is non-zero.\n\nA reference count rather than a simple flag is necessary because\nmultiple handlers can operate on the same descriptor concurrently\n(e.g. IBRD and IBWAIT on the same handle from different threads).\n\nA separate counter is needed because io_in_progress can be cleared from\nunprivileged userspace via the IBWAIT ioctl (through general_ibstatus()\nwith set_mask containing CMPL), which would allow an attacker to bypass\na check based solely on io_in_progress.  The new descriptor_busy\ncounter is only modified by the kernel IO paths.\n\nThe lock ordering is consistent (big_gpib_mutex -> descriptors_mutex)\nand the handlers only hold descriptors_mutex briefly during the lookup,\nso there is no deadlock risk and no impact on IO throughput."}],"id":"CVE-2026-31769","lastModified":"2026-06-17T10:34:25.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:40.090","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28c75dd143ead62e0dfac564c79d251e21d5d74b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1857f8296dceb75d00ab857fc3c61bc00c7f5c6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpib/common/gpib_os.c","drivers/gpib/include/gpib_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c","status":"affected","version":"9dde4559e93955ccc47d588f7fd051684d55c4e7","versionType":"git"},{"lessThan":"28c75dd143ead62e0dfac564c79d251e21d5d74b","status":"affected","version":"9dde4559e93955ccc47d588f7fd051684d55c4e7","versionType":"git"},{"lessThan":"d1857f8296dceb75d00ab857fc3c61bc00c7f5c6","status":"affected","version":"9dde4559e93955ccc47d588f7fd051684d55c4e7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpib/common/gpib_os.c","drivers/gpib/include/gpib_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpib: fix use-after-free in IO ioctl handlers\n\nThe IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers use a gpib_descriptor\npointer after board->big_gpib_mutex has been released.  A concurrent\nIBCLOSEDEV ioctl can free the descriptor via close_dev_ioctl() during\nthis window, causing a use-after-free.\n\nThe IO handlers (read_ioctl, write_ioctl, command_ioctl) explicitly\nrelease big_gpib_mutex before calling their handler.  wait_ioctl() is\ncalled with big_gpib_mutex held, but ibwait() releases it internally\nwhen wait_mask is non-zero.  In all four cases, the descriptor pointer\nobtained from handle_to_descriptor() becomes unprotected.\n\nFix this by introducing a kernel-only descriptor_busy reference count\nin struct gpib_descriptor.  Each handler atomically increments\ndescriptor_busy under file_priv->descriptors_mutex before releasing the\nlock, and decrements it when done.  close_dev_ioctl() checks\ndescriptor_busy under the same lock and rejects the close with -EBUSY\nif the count is non-zero.\n\nA reference count rather than a simple flag is necessary because\nmultiple handlers can operate on the same descriptor concurrently\n(e.g. IBRD and IBWAIT on the same handle from different threads).\n\nA separate counter is needed because io_in_progress can be cleared from\nunprivileged userspace via the IBWAIT ioctl (through general_ibstatus()\nwith set_mask containing CMPL), which would allow an attacker to bypass\na check based solely on io_in_progress.  The new descriptor_busy\ncounter is only modified by the kernel IO paths.\n\nThe lock ordering is consistent (big_gpib_mutex -> descriptors_mutex)\nand the handlers only hold descriptors_mutex briefly during the lookup,\nso there is no deadlock risk and no impact on IO throughput."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpib: corrección de uso después de liberación en los gestores ioctl de E/S\n\nLos gestores ioctl IBRD, IBWRT, IBCMD e IBWAIT usan un puntero gpib_descriptor después de que board  ->  big_gpib_mutex ha sido liberado. Un ioctl IBCLOSEDEV concurrente puede liberar el descriptor a través de close_dev_ioctl() durante esta ventana, causando un uso después de liberación.\n\nLos gestores de E/S (read_ioctl, write_ioctl, command_ioctl) liberan explícitamente big_gpib_mutex antes de llamar a su gestor. wait_ioctl() se llama con big_gpib_mutex retenido, pero ibwait() lo libera internamente cuando wait_mask es distinto de cero. En los cuatro casos, el puntero del descriptor obtenido de handle_to_descriptor() queda desprotegido.\n\nEsto se soluciona introduciendo un contador de referencias descriptor_busy solo para el kernel en la estructura gpib_descriptor. Cada gestor incrementa atómicamente descriptor_busy bajo file_priv  ->  descriptors_mutex antes de liberar el bloqueo, y lo decrementa al finalizar. close_dev_ioctl() comprueba descriptor_busy bajo el mismo bloqueo y rechaza el cierre con -EBUSY si el contador es distinto de cero.\n\nEs necesario un contador de referencias en lugar de un simple indicador porque múltiples gestores pueden operar sobre el mismo descriptor concurrentemente (por ejemplo, IBRD e IBWAIT en el mismo identificador desde hilos diferentes).\n\nSe necesita un contador separado porque io_in_progress puede borrarse desde el espacio de usuario sin privilegios a través del ioctl IBWAIT (mediante general_ibstatus() con set_mask conteniendo CMPL), lo que permitiría a un atacante eludir una comprobación basada únicamente en io_in_progress. El nuevo contador descriptor_busy solo es modificado por las rutas de E/S del kernel.\n\nEl orden de bloqueo es consistente (big_gpib_mutex   ->   descriptors_mutex) y los gestores solo retienen descriptors_mutex brevemente durante la búsqueda, por lo que no hay riesgo de interbloqueo ni impacto en el rendimiento de E/S."}],"id":"CVE-2026-31769","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:40.090","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28c75dd143ead62e0dfac564c79d251e21d5d74b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cae26eff1b56d78bed7873cf3e60a2b1bdd4da6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1857f8296dceb75d00ab857fc3c61bc00c7f5c6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31770.json b/data/2026/CVE-2026-31770.json
index 3c9a2dd66e..218a8c1b8d 100644
--- a/data/2026/CVE-2026-31770.json
+++ b/data/2026/CVE-2026-31770.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hwmon/occ/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c7d3712362c8ab8f82f441b649d9e446e7b9aa9d","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"53e6175756b8c474b6247bbcea0aad3d68357475","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"2502684b9e835de9a992ec47c3e6c6faabe3858d","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"37ae8fadc74ed68e5bc364ffd17746d88e449ae3","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"bbbefc48f6617cfb738dcff7f44beb50b5dfeb38","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"243d55bd3f08cb15eee9d63f4716d4d4cdd760f5","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"7b89ce0c98bf3015f493ca4285b2d1056cd8c733","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"39e2a5bf970402a8530a319cf06122e216ba57b8","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hwmon/occ/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A58C0269-40CC-43D7-8F8A-B2C38025D165","versionEndExcluding":"5.10.253","versionStartIncluding":"5.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (occ) Fix division by zero in occ_show_power_1()\n\nIn occ_show_power_1() case 1, the accumulator is divided by\nupdate_tag without checking for zero. If no samples have been\ncollected yet (e.g. during early boot when the sensor block is\nincluded but hasn't been updated), update_tag is zero, causing\na kernel divide-by-zero crash.\n\nThe 2019 fix in commit 211186cae14d (\"hwmon: (occ) Fix division by\nzero issue\") only addressed occ_get_powr_avg() used by\nocc_show_power_2() and occ_show_power_a0(). This separate code\npath in occ_show_power_1() was missed.\n\nFix this by reusing the existing occ_get_powr_avg() helper, which\nalready handles the zero-sample case and uses mul_u64_u32_div()\nto multiply before dividing for better precision. Move the helper\nabove occ_show_power_1() so it is visible at the call site.\n\n[groeck: Fix alignment problems reported by checkpatch]"}],"id":"CVE-2026-31770","lastModified":"2026-06-17T10:34:25.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:40.200","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/243d55bd3f08cb15eee9d63f4716d4d4cdd760f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2502684b9e835de9a992ec47c3e6c6faabe3858d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37ae8fadc74ed68e5bc364ffd17746d88e449ae3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39e2a5bf970402a8530a319cf06122e216ba57b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53e6175756b8c474b6247bbcea0aad3d68357475"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b89ce0c98bf3015f493ca4285b2d1056cd8c733"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbbefc48f6617cfb738dcff7f44beb50b5dfeb38"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c7d3712362c8ab8f82f441b649d9e446e7b9aa9d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hwmon/occ/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c7d3712362c8ab8f82f441b649d9e446e7b9aa9d","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"53e6175756b8c474b6247bbcea0aad3d68357475","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"2502684b9e835de9a992ec47c3e6c6faabe3858d","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"37ae8fadc74ed68e5bc364ffd17746d88e449ae3","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"bbbefc48f6617cfb738dcff7f44beb50b5dfeb38","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"243d55bd3f08cb15eee9d63f4716d4d4cdd760f5","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"7b89ce0c98bf3015f493ca4285b2d1056cd8c733","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"},{"lessThan":"39e2a5bf970402a8530a319cf06122e216ba57b8","status":"affected","version":"c10e753d43ebd1d17e1c62bcee20c6124c2c7cca","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hwmon/occ/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A58C0269-40CC-43D7-8F8A-B2C38025D165","versionEndExcluding":"5.10.253","versionStartIncluding":"5.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (occ) Fix division by zero in occ_show_power_1()\n\nIn occ_show_power_1() case 1, the accumulator is divided by\nupdate_tag without checking for zero. If no samples have been\ncollected yet (e.g. during early boot when the sensor block is\nincluded but hasn't been updated), update_tag is zero, causing\na kernel divide-by-zero crash.\n\nThe 2019 fix in commit 211186cae14d (\"hwmon: (occ) Fix division by\nzero issue\") only addressed occ_get_powr_avg() used by\nocc_show_power_2() and occ_show_power_a0(). This separate code\npath in occ_show_power_1() was missed.\n\nFix this by reusing the existing occ_get_powr_avg() helper, which\nalready handles the zero-sample case and uses mul_u64_u32_div()\nto multiply before dividing for better precision. Move the helper\nabove occ_show_power_1() so it is visible at the call site.\n\n[groeck: Fix alignment problems reported by checkpatch]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhwmon: (occ) Corrección de división por cero en occ_show_power_1()\n\nEn occ_show_power_1() caso 1, el acumulador es dividido por update_tag sin comprobar si es cero. Si aún no se han recopilado muestras (p. ej., durante el arranque temprano cuando el bloque del sensor está incluido pero no ha sido actualizado), update_tag es cero, causando un fallo de división por cero del kernel.\n\nLa corrección de 2019 en el commit 211186cae14d (’hwmon: (occ) Corrección de problema de división por cero’) solo abordó occ_get_powr_avg() utilizado por occ_show_power_2() y occ_show_power_a0(). Esta ruta de código separada en occ_show_power_1() se pasó por alto.\n\nSolucione esto reutilizando la función auxiliar occ_get_powr_avg() existente, que ya maneja el caso de cero muestras y utiliza mul_u64_u32_div() para multiplicar antes de dividir para una mejor precisión. Mueva la función auxiliar por encima de occ_show_power_1() para que sea visible en el sitio de llamada.\n\n[groeck: Corrección de problemas de alineación reportados por checkpatch]"}],"id":"CVE-2026-31770","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:40.200","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/243d55bd3f08cb15eee9d63f4716d4d4cdd760f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2502684b9e835de9a992ec47c3e6c6faabe3858d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37ae8fadc74ed68e5bc364ffd17746d88e449ae3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39e2a5bf970402a8530a319cf06122e216ba57b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53e6175756b8c474b6247bbcea0aad3d68357475"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b89ce0c98bf3015f493ca4285b2d1056cd8c733"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbbefc48f6617cfb738dcff7f44beb50b5dfeb38"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c7d3712362c8ab8f82f441b649d9e446e7b9aa9d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31771.json b/data/2026/CVE-2026-31771.json
index 2227e3a405..ffd0a1f0b3 100644
--- a/data/2026/CVE-2026-31771.json
+++ b/data/2026/CVE-2026-31771.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbea63d0d301edd4a42f4390b49b8519d78b802d","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"1e4b738dd0d0f7b237686167706badad9d30649c","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"ac7889b0fe441e4ef892c40b1d002e91f93fa4ae","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"86c8d07a64d553c41e213b52650020010f9ef23e","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"2b2bf47cd75518c36fa2d41380e4a40641cc89cd","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5C6630F4-82C7-43EE-A9AC-FF59BBAEEDD1","versionEndExcluding":"6.19.12","versionStartIncluding":"5.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(&hdev->lock) and add\nlockdep_assert_held(&hdev->lock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt()."}],"id":"CVE-2026-31771","lastModified":"2026-10-30T13:18:43.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31771","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:04.391952Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.337","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1e4b738dd0d0f7b237686167706badad9d30649c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ac7889b0fe441e4ef892c40b1d002e91f93fa4ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fbea63d0d301edd4a42f4390b49b8519d78b802d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbea63d0d301edd4a42f4390b49b8519d78b802d","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"1e4b738dd0d0f7b237686167706badad9d30649c","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"ac7889b0fe441e4ef892c40b1d002e91f93fa4ae","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"86c8d07a64d553c41e213b52650020010f9ef23e","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"},{"lessThan":"2b2bf47cd75518c36fa2d41380e4a40641cc89cd","status":"affected","version":"2f20216c1d6fe17c1a224f658be0dc6fab2269c7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5C6630F4-82C7-43EE-A9AC-FF59BBAEEDD1","versionEndExcluding":"6.19.12","versionStartIncluding":"5.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(&hdev->lock) and add\nlockdep_assert_held(&hdev->lock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: hci_event: mover el almacenamiento del motivo de activación a los gestores de eventos validados\n\nhci_store_wake_reason() es llamada desde hci_event_packet() inmediatamente después de eliminar la cabecera del evento HCI pero antes de que hci_event_func() imponga la longitud mínima de carga útil por evento de hci_ev_table. Esto significa que una trama de evento HCI corta puede alcanzar bacpy() antes de que se ejecute cualquier comprobación de límites.\n\nEn lugar de duplicar el análisis de skb y las comprobaciones de longitud por evento dentro de hci_store_wake_reason(), mover el almacenamiento de la dirección de activación a los gestores de eventos individuales después de que su validación de longitud de evento existente haya tenido éxito. Convertir hci_store_wake_reason() en una pequeña función auxiliar que solo almacena una bdaddr ya validada mientras el llamador mantiene hci_dev_lock(). Usar la misma función auxiliar después de hci_event_func() con una dirección NULL para preservar la semántica de reserva de activación inesperada existente cuando ningún gestor de eventos validado registra una dirección de activación.\n\nAnotar la función auxiliar con __must_hold(&hdev  ->  lock) y añadir lockdep_assert_held(&hdev  ->  lock) para que las futuras rutas de llamada mantengan explícito el contrato de bloqueo.\n\nLlamar a la función auxiliar desde hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), y hci_le_past_received_evt()."}],"id":"CVE-2026-31771","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31771","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:04.391952Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.337","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1e4b738dd0d0f7b237686167706badad9d30649c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ac7889b0fe441e4ef892c40b1d002e91f93fa4ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dbc8b8d33c9e19e17e8b8b1361bbb46e2983f5f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fbea63d0d301edd4a42f4390b49b8519d78b802d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31772.json b/data/2026/CVE-2026-31772.json
index 90523b89ce..ed21cccf0b 100644
--- a/data/2026/CVE-2026-31772.json
+++ b/data/2026/CVE-2026-31772.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f5d446624345d309e7a4a1b27ea9f028d6a8c5d9","status":"affected","version":"91d19383b7ed035e22165ae5c836e50bb9f95fbe","versionType":"git"},{"lessThan":"aba0aea354015794e8312dd7efe726967e58aefe","status":"affected","version":"42ecf1947135110ea08abeaca39741636f9a2285","versionType":"git"},{"lessThan":"eaf32002ca7b1ba51c9f140991fd9febe6de79f0","status":"affected","version":"42ecf1947135110ea08abeaca39741636f9a2285","versionType":"git"},{"lessThan":"bc39a094730ce062fa034a529c93147c096cb488","status":"affected","version":"42ecf1947135110ea08abeaca39741636f9a2285","versionType":"git"},{"status":"affected","version":"8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd","versionType":"git"},{"lessThan":"6.12.81","status":"affected","version":"6.12.2","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CBF5F6E-D446-4CAE-AAA4-413442319824","versionEndExcluding":"6.12","versionStartIncluding":"6.11.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2B5546BA-4E7F-4FB9-9ED6-3DD23FE96C38","versionEndExcluding":"6.12.81","versionStartIncluding":"6.12.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8CBC12FA-A2A3-4882-BEB3-38ED3AC5AD57","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*","matchCriteriaId":"5A3F9505-6B98-4269-8B81-127E55A1BF00","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync\n\nhci_le_big_create_sync() uses DEFINE_FLEX to allocate a\nstruct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)\nBIS entries.  However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)\nentries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller\nhci_conn_big_create_sync().  When conn->num_bis is between 18 and 31,\nthe memcpy that copies conn->bis into cp->bis writes up to 14 bytes\npast the stack buffer, corrupting adjacent stack memory.\n\nThis is trivially reproducible: binding an ISO socket with\nbc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will\neventually trigger hci_le_big_create_sync() from the HCI command\nsync worker, causing a KASAN-detectable stack-out-of-bounds write:\n\n  BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0\n  Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71\n\nFix this by changing the DEFINE_FLEX count from the incorrect 0x11 to\nHCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that\nconn->bis can actually carry."}],"id":"CVE-2026-31772","lastModified":"2026-10-19T20:17:58.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31772","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:07.170153Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.470","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aba0aea354015794e8312dd7efe726967e58aefe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bc39a094730ce062fa034a529c93147c096cb488"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eaf32002ca7b1ba51c9f140991fd9febe6de79f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f5d446624345d309e7a4a1b27ea9f028d6a8c5d9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f5d446624345d309e7a4a1b27ea9f028d6a8c5d9","status":"affected","version":"91d19383b7ed035e22165ae5c836e50bb9f95fbe","versionType":"git"},{"lessThan":"aba0aea354015794e8312dd7efe726967e58aefe","status":"affected","version":"42ecf1947135110ea08abeaca39741636f9a2285","versionType":"git"},{"lessThan":"eaf32002ca7b1ba51c9f140991fd9febe6de79f0","status":"affected","version":"42ecf1947135110ea08abeaca39741636f9a2285","versionType":"git"},{"lessThan":"bc39a094730ce062fa034a529c93147c096cb488","status":"affected","version":"42ecf1947135110ea08abeaca39741636f9a2285","versionType":"git"},{"status":"affected","version":"8958e1cee4e2eac1a5b825caa4dd96ce9ed975dd","versionType":"git"},{"lessThan":"6.12.81","status":"affected","version":"6.12.2","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CBF5F6E-D446-4CAE-AAA4-413442319824","versionEndExcluding":"6.12","versionStartIncluding":"6.11.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2B5546BA-4E7F-4FB9-9ED6-3DD23FE96C38","versionEndExcluding":"6.12.81","versionStartIncluding":"6.12.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8CBC12FA-A2A3-4882-BEB3-38ED3AC5AD57","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*","matchCriteriaId":"5A3F9505-6B98-4269-8B81-127E55A1BF00","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync\n\nhci_le_big_create_sync() uses DEFINE_FLEX to allocate a\nstruct hci_cp_le_big_create_sync on the stack with room for 0x11 (17)\nBIS entries.  However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31)\nentries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller\nhci_conn_big_create_sync().  When conn->num_bis is between 18 and 31,\nthe memcpy that copies conn->bis into cp->bis writes up to 14 bytes\npast the stack buffer, corrupting adjacent stack memory.\n\nThis is trivially reproducible: binding an ISO socket with\nbc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will\neventually trigger hci_le_big_create_sync() from the HCI command\nsync worker, causing a KASAN-detectable stack-out-of-bounds write:\n\n  BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0\n  Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71\n\nFix this by changing the DEFINE_FLEX count from the incorrect 0x11 to\nHCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that\nconn->bis can actually carry."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: hci_sync: corregir desbordamiento de búfer de pila en hci_le_big_create_sync\n\nhci_le_big_create_sync() utiliza DEFINE_FLEX para asignar una estructura hci_cp_le_big_create_sync en la pila con espacio para 0x11 (17) entradas BIS. Sin embargo, conn  ->  num_bis puede contener hasta HCI_MAX_ISO_BIS (31) entradas - validado contra ISO_MAX_NUM_BIS (0x1f) en la función llamadora hci_conn_big_create_sync(). Cuando conn  ->  num_bis está entre 18 y 31, la función memcpy que copia conn  ->  bis en cp  ->  bis escribe hasta 14 bytes más allá del búfer de pila, corrompiendo la memoria de pila adyacente.\n\nEsto es trivialmente reproducible: vincular un socket ISO con bc_num_bis = ISO_MAX_NUM_BIS (31) y llamar a listen() eventualmente activará hci_le_big_create_sync() desde el trabajador de sincronización de comandos HCI, causando una escritura fuera de límites de pila detectable por KASAN:\n\n  BUG: KASAN: stack-out-of-bounds en hci_le_big_create_sync+0x256/0x3b0\n  Escritura de tamaño 31 en la dirección ffffc90000487b48 por la tarea kworker/u9:0/71\n\nSolucione esto cambiando el recuento de DEFINE_FLEX del incorrecto 0x11 a HCI_MAX_ISO_BIS, lo que coincide con el número máximo de entradas BIS que conn  ->  bis puede realmente contener."}],"id":"CVE-2026-31772","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31772","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:07.170153Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.470","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aba0aea354015794e8312dd7efe726967e58aefe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bc39a094730ce062fa034a529c93147c096cb488"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eaf32002ca7b1ba51c9f140991fd9febe6de79f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f5d446624345d309e7a4a1b27ea9f028d6a8c5d9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31773.json b/data/2026/CVE-2026-31773.json
index 80cdec805e..3bfdf512c0 100644
--- a/data/2026/CVE-2026-31773.json
+++ b/data/2026/CVE-2026-31773.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9a38659a3d06080715691bd3139f9c4b61f688e3","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"667f44f1392df6482483756458c48670e579e9ff","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"929db734d12db41ca5f95424db4612397f1bd4a7","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"b1c6a8e554a39b222c0879a288ea98e338fc4d77","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"0afc846bd80073ffcd2b8040f2b2fafaea3d9f72","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"061ee71ac6b03c9f8432fe49538c3682bfcf4cf3","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"9a6d0db176f082685e0b6149700c0baf3ce2aa8b","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"20756fec2f0108cb88e815941f1ffff88dc286fe","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"status":"affected","version":"14ec593d6bb050cf40a4ade2f9ac9ca050e0412c","versionType":"git"},{"lessThan":"3.16","status":"affected","version":"3.15.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.16"},{"lessThan":"3.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7AB7F235-CA17-4469-8F49-E61F880EF22E","versionEndExcluding":"3.16","versionStartIncluding":"3.15.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0D5B310C-1F2B-40A6-BD8F-4AD7CA6B8B1D","versionEndExcluding":"5.10.253","versionStartIncluding":"3.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.16:-:*:*:*:*:*:*","matchCriteriaId":"18374217-75DB-4E06-8293-8AAC0FD9D6C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: derive legacy responder STK authentication from MITM state\n\nThe legacy responder path in smp_random() currently labels the stored\nSTK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.\nThat reflects what the local service requested, not what the pairing\nflow actually achieved.\n\nFor Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear\nand the resulting STK should remain unauthenticated even if the local\nside requested HIGH security. Use the established MITM state when\nstoring the responder STK so the key metadata matches the pairing result.\n\nThis also keeps the legacy path aligned with the Secure Connections code,\nwhich already treats JUST_WORKS/JUST_CFM as unauthenticated."}],"id":"CVE-2026-31773","lastModified":"2026-10-19T20:17:58.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31773","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:09.381420Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.587","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/061ee71ac6b03c9f8432fe49538c3682bfcf4cf3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0afc846bd80073ffcd2b8040f2b2fafaea3d9f72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20756fec2f0108cb88e815941f1ffff88dc286fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/667f44f1392df6482483756458c48670e579e9ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/929db734d12db41ca5f95424db4612397f1bd4a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a38659a3d06080715691bd3139f9c4b61f688e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a6d0db176f082685e0b6149700c0baf3ce2aa8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1c6a8e554a39b222c0879a288ea98e338fc4d77"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9a38659a3d06080715691bd3139f9c4b61f688e3","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"667f44f1392df6482483756458c48670e579e9ff","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"929db734d12db41ca5f95424db4612397f1bd4a7","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"b1c6a8e554a39b222c0879a288ea98e338fc4d77","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"0afc846bd80073ffcd2b8040f2b2fafaea3d9f72","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"061ee71ac6b03c9f8432fe49538c3682bfcf4cf3","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"9a6d0db176f082685e0b6149700c0baf3ce2aa8b","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"lessThan":"20756fec2f0108cb88e815941f1ffff88dc286fe","status":"affected","version":"fff3490f47810e2d34b91fb9e31103e923b11c2f","versionType":"git"},{"status":"affected","version":"14ec593d6bb050cf40a4ade2f9ac9ca050e0412c","versionType":"git"},{"lessThan":"3.16","status":"affected","version":"3.15.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.16"},{"lessThan":"3.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7AB7F235-CA17-4469-8F49-E61F880EF22E","versionEndExcluding":"3.16","versionStartIncluding":"3.15.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0D5B310C-1F2B-40A6-BD8F-4AD7CA6B8B1D","versionEndExcluding":"5.10.253","versionStartIncluding":"3.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.16:-:*:*:*:*:*:*","matchCriteriaId":"18374217-75DB-4E06-8293-8AAC0FD9D6C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: derive legacy responder STK authentication from MITM state\n\nThe legacy responder path in smp_random() currently labels the stored\nSTK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.\nThat reflects what the local service requested, not what the pairing\nflow actually achieved.\n\nFor Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear\nand the resulting STK should remain unauthenticated even if the local\nside requested HIGH security. Use the established MITM state when\nstoring the responder STK so the key metadata matches the pairing result.\n\nThis also keeps the legacy path aligned with the Secure Connections code,\nwhich already treats JUST_WORKS/JUST_CFM as unauthenticated."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: SMP: derivar la autenticación STK del respondedor heredado del estado MitM\n\nLa ruta del respondedor heredado en smp_random() actualmente etiqueta la STK almacenada como autenticada siempre que pending_sec_level sea BT_SECURITY_HIGH. Eso refleja lo que el servicio local solicitó, no lo que el flujo de emparejamiento realmente logró.\n\nPara el emparejamiento heredado Just Works/Confirm, SMP_FLAG_MITM_AUTH permanece despejado y la STK resultante debería permanecer sin autenticar incluso si el lado local solicitó seguridad ALTA. Utilice el estado MitM establecido al almacenar la STK del respondedor para que los metadatos de la clave coincidan con el resultado del emparejamiento.\n\nEsto también mantiene la ruta heredada alineada con el código de Conexiones Seguras, que ya trata JUST_WORKS/JUST_CFM como sin autenticar."}],"id":"CVE-2026-31773","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31773","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:09.381420Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.587","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/061ee71ac6b03c9f8432fe49538c3682bfcf4cf3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0afc846bd80073ffcd2b8040f2b2fafaea3d9f72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20756fec2f0108cb88e815941f1ffff88dc286fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/667f44f1392df6482483756458c48670e579e9ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/929db734d12db41ca5f95424db4612397f1bd4a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a38659a3d06080715691bd3139f9c4b61f688e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a6d0db176f082685e0b6149700c0baf3ce2aa8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1c6a8e554a39b222c0879a288ea98e338fc4d77"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31774.json b/data/2026/CVE-2026-31774.json
index 64eb843e67..766baeb887 100644
--- a/data/2026/CVE-2026-31774.json
+++ b/data/2026/CVE-2026-31774.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["io_uring/net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"90ced24c500ad4e129e9e34b7e56fd7849e350b6","status":"affected","version":"a05d1f625c7aa681d8816bc0f10089289ad07aad","versionType":"git"},{"lessThan":"c314b405dcc4d8b9041124f928f81715d6328bec","status":"affected","version":"a05d1f625c7aa681d8816bc0f10089289ad07aad","versionType":"git"},{"lessThan":"1b655cd311344117d3052f6552cb20d9901c9d7c","status":"affected","version":"a05d1f625c7aa681d8816bc0f10089289ad07aad","versionType":"git"},{"lessThan":"b948f9d5d3057b01188e36664e7c7604d1c8ecb5","status":"affected","version":"a05d1f625c7aa681d8816bc0f10089289ad07aad","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["io_uring/net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"152F22C9-12F1-4E51-A98B-BC5F10DD76FD","versionEndExcluding":"6.12.81","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()\n\nsqe->len is __u32 but gets stored into sr->len which is int. When\nuserspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF),\nsr->len overflows to a negative value. This negative value propagates\nthrough the bundle recv/send path:\n\n  1. io_recv(): sel.val = sr->len (ssize_t gets -1)\n  2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets\n     0xFFFFFFFFFFFFFFFF)\n  3. io_ring_buffers_peek(): buf->len is not clamped because max_len\n     is astronomically large\n  4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs()\n  5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1,\n     causing ret to increase instead of decrease, creating an\n     infinite loop that reads past the allocated iov[] array\n\nThis results in a slab-out-of-bounds read in io_bundle_nbufs() from\nthe kmalloc-64 slab, as nbufs increments past the allocated iovec\nentries.\n\n  BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160\n  Read of size 8 at addr ffff888100ae05c8 by task exp/145\n  Call Trace:\n   io_bundle_nbufs+0x128/0x160\n   io_recv_finish+0x117/0xe20\n   io_recv+0x2db/0x1160\n\nFix this by rejecting negative sr->len values early in both\nio_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32,\nany value > INT_MAX indicates overflow and is not a valid length."}],"id":"CVE-2026-31774","lastModified":"2026-10-19T20:17:59.037","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31774","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:11.625324Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.720","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b655cd311344117d3052f6552cb20d9901c9d7c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/90ced24c500ad4e129e9e34b7e56fd7849e350b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b948f9d5d3057b01188e36664e7c7604d1c8ecb5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c314b405dcc4d8b9041124f928f81715d6328bec"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["io_uring/net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"90ced24c500ad4e129e9e34b7e56fd7849e350b6","status":"affected","version":"a05d1f625c7aa681d8816bc0f10089289ad07aad","versionType":"git"},{"lessThan":"c314b405dcc4d8b9041124f928f81715d6328bec","status":"affected","version":"a05d1f625c7aa681d8816bc0f10089289ad07aad","versionType":"git"},{"lessThan":"1b655cd311344117d3052f6552cb20d9901c9d7c","status":"affected","version":"a05d1f625c7aa681d8816bc0f10089289ad07aad","versionType":"git"},{"lessThan":"b948f9d5d3057b01188e36664e7c7604d1c8ecb5","status":"affected","version":"a05d1f625c7aa681d8816bc0f10089289ad07aad","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["io_uring/net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"152F22C9-12F1-4E51-A98B-BC5F10DD76FD","versionEndExcluding":"6.12.81","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()\n\nsqe->len is __u32 but gets stored into sr->len which is int. When\nuserspace passes sqe->len values exceeding INT_MAX (e.g. 0xFFFFFFFF),\nsr->len overflows to a negative value. This negative value propagates\nthrough the bundle recv/send path:\n\n  1. io_recv(): sel.val = sr->len (ssize_t gets -1)\n  2. io_recv_buf_select(): arg.max_len = sel->val (size_t gets\n     0xFFFFFFFFFFFFFFFF)\n  3. io_ring_buffers_peek(): buf->len is not clamped because max_len\n     is astronomically large\n  4. iov[].iov_len = 0xFFFFFFFF flows into io_bundle_nbufs()\n  5. io_bundle_nbufs(): min_t(int, 0xFFFFFFFF, ret) yields -1,\n     causing ret to increase instead of decrease, creating an\n     infinite loop that reads past the allocated iov[] array\n\nThis results in a slab-out-of-bounds read in io_bundle_nbufs() from\nthe kmalloc-64 slab, as nbufs increments past the allocated iovec\nentries.\n\n  BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160\n  Read of size 8 at addr ffff888100ae05c8 by task exp/145\n  Call Trace:\n   io_bundle_nbufs+0x128/0x160\n   io_recv_finish+0x117/0xe20\n   io_recv+0x2db/0x1160\n\nFix this by rejecting negative sr->len values early in both\nio_sendmsg_prep() and io_recvmsg_prep(). Since sqe->len is __u32,\nany value > INT_MAX indicates overflow and is not a valid length."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nio_uring/net: corrige lectura fuera de límites de slab en io_bundle_nbufs()\n\nsqe  ->  len es __u32 pero se almacena en sr  ->  len, que es int. Cuando el espacio de usuario pasa valores de sqe  ->  len que exceden INT_MAX (p. ej., 0x FFFFFFFF), sr  ->  len desborda a un valor negativo. Este valor negativo se propaga a través de la ruta de recepción/envío del paquete:\n\n  1. io_recv(): sel.val = sr  ->  len (ssize_t obtiene -1)\n  2. io_recv_buf_select(): arg.max_len = sel  ->  val (size_t obtiene 0x FFFFFFFFFFFFFFFF)\n  3. io_ring_buffers_peek(): buf  ->  len no se limita porque max_len es astronómicamente grande\n  4. iov[].iov_len = 0x FFFFFFFF fluye hacia io_bundle_nbufs()\n  5. io_bundle_nbufs(): min_t(int, 0x FFFFFFFF, ret) produce -1, haciendo que ret aumente en lugar de disminuir, creando un bucle infinito que lee más allá del array iov[] asignado\n\nEsto resulta en una lectura fuera de límites de slab en io_bundle_nbufs() desde el slab kmalloc-64, a medida que nbufs se incrementa más allá de las entradas iovec asignadas.\n\n  BUG: KASAN: slab-out-of-bounds in io_bundle_nbufs+0x128/0x160\n  Lectura de tamaño 8 en la dirección ffff888100ae05c8 por la tarea exp/145\n  Traza de Llamada:\n   io_bundle_nbufs+0x128/0x160\n   io_recv_finish+0x117/0xe20\n   io_recv+0x2db/0x 1160\n\nEsto se soluciona rechazando valores negativos de sr  ->  len temprano tanto en io_sendmsg_prep() como en io_recvmsg_prep(). Dado que sqe  ->  len es __u32, cualquier valor > INT_MAX indica desbordamiento y no es una longitud válida."}],"id":"CVE-2026-31774","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31774","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:11.625324Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.720","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b655cd311344117d3052f6552cb20d9901c9d7c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/90ced24c500ad4e129e9e34b7e56fd7849e350b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b948f9d5d3057b01188e36664e7c7604d1c8ecb5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c314b405dcc4d8b9041124f928f81715d6328bec"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31775.json b/data/2026/CVE-2026-31775.json
index 846a8312f1..880d51d2a0 100644
--- a/data/2026/CVE-2026-31775.json
+++ b/data/2026/CVE-2026-31775.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/pci/ctxfi/ctatc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7fca3600e79e9f8bac1ebc10af9ff20a35d6cccb","status":"affected","version":"88cc09bb70651917ef8b7095a05a21a9ca014c94","versionType":"git"},{"lessThan":"a79c4c42057818bd9de45d2627464b4f0e02196a","status":"affected","version":"a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16","versionType":"git"},{"lessThan":"75dc1980cf48826287e43dc7a49e310c6691f97e","status":"affected","version":"a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16","versionType":"git"},{"lessThan":"6.18.59","status":"affected","version":"6.18.57","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/pci/ctxfi/ctatc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.59","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization\n\nThe recent refactoring of xfi driver changed the assignment of\natc->daios[] at atc_get_resources(); now it loops over all enum\nDAIOTYP entries while it looped formerly only a part of them.\nThe problem is that the last entry, SPDIF1, is a special type that\nis used only for hw20k1 CTSB073X model (as a replacement of SPDIFIO),\nand there is no corresponding definition for hw20k2.  Due to the lack\nof the info, it caused a kernel crash on hw20k2, which was already\nworked around by the commit b045ab3dff97 (\"ALSA: ctxfi: Fix missing\nSPDIFI1 index handling\").\n\nThis patch addresses the root cause of the regression above properly,\nsimply by skipping the incorrect SPDIF1 type in the parser loop.\n\nFor making the change clearer, the code is slightly arranged, too."}],"id":"CVE-2026-31775","lastModified":"2026-11-06T16:18:10.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31775","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:11.831500Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.863","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75dc1980cf48826287e43dc7a49e310c6691f97e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7fca3600e79e9f8bac1ebc10af9ff20a35d6cccb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a79c4c42057818bd9de45d2627464b4f0e02196a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/pci/ctxfi/ctatc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7fca3600e79e9f8bac1ebc10af9ff20a35d6cccb","status":"affected","version":"88cc09bb70651917ef8b7095a05a21a9ca014c94","versionType":"git"},{"lessThan":"a79c4c42057818bd9de45d2627464b4f0e02196a","status":"affected","version":"a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16","versionType":"git"},{"lessThan":"75dc1980cf48826287e43dc7a49e310c6691f97e","status":"affected","version":"a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16","versionType":"git"},{"lessThan":"6.18.59","status":"affected","version":"6.18.57","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/pci/ctxfi/ctatc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.59","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization\n\nThe recent refactoring of xfi driver changed the assignment of\natc->daios[] at atc_get_resources(); now it loops over all enum\nDAIOTYP entries while it looped formerly only a part of them.\nThe problem is that the last entry, SPDIF1, is a special type that\nis used only for hw20k1 CTSB073X model (as a replacement of SPDIFIO),\nand there is no corresponding definition for hw20k2.  Due to the lack\nof the info, it caused a kernel crash on hw20k2, which was already\nworked around by the commit b045ab3dff97 (\"ALSA: ctxfi: Fix missing\nSPDIFI1 index handling\").\n\nThis patch addresses the root cause of the regression above properly,\nsimply by skipping the incorrect SPDIF1 type in the parser loop.\n\nFor making the change clearer, the code is slightly arranged, too."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: ctxfi: No enumerar SPDIF1 en la inicialización de DAIO\n\nLa reciente refactorización del controlador xfi cambió la asignación de atc  ->  daios[] en atc_get_resources(); ahora itera sobre todas las entradas enum DAIOTYP mientras que anteriormente solo iteraba sobre una parte de ellas. El problema es que la última entrada, SPDIF1, es un tipo especial que se utiliza solo para el modelo hw20k1 CTSB073X (como reemplazo de SPDIFIO), y no hay una definición correspondiente para hw20k2. Debido a la falta de información, causó un fallo del kernel en hw20k2, lo cual ya había sido solucionado provisionalmente por el commit b045ab3dff97 (’ALSA: ctxfi: Solucionar el manejo faltante del índice SPDIFI1’).\n\nEste parche aborda correctamente la causa raíz de la regresión anterior, simplemente omitiendo el tipo SPDIF1 incorrecto en el bucle del analizador.\n\nPara hacer el cambio más claro, el código también se ha organizado ligeramente."}],"id":"CVE-2026-31775","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31775","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:11.831500Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.863","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75dc1980cf48826287e43dc7a49e310c6691f97e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7fca3600e79e9f8bac1ebc10af9ff20a35d6cccb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a79c4c42057818bd9de45d2627464b4f0e02196a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31776.json b/data/2026/CVE-2026-31776.json
index bfccbf4316..b2b4780bb1 100644
--- a/data/2026/CVE-2026-31776.json
+++ b/data/2026/CVE-2026-31776.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/pci/ctxfi/ctdaio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"950decf59d4e978b60a792ce0b3e1555a608f489","status":"affected","version":"a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16","versionType":"git"},{"lessThan":"b045ab3dff97edae6d538eeff900a34c098761f8","status":"affected","version":"a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/pci/ctxfi/ctdaio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix missing SPDIFI1 index handling\n\nSPDIF1 DAIO type isn't properly handled in daio_device_index() for\nhw20k2, and it returned -EINVAL, which ended up with the out-of-bounds\narray access.  Follow the hw20k1 pattern and return the proper index\nfor this type, too."}],"id":"CVE-2026-31776","lastModified":"2026-11-06T16:18:10.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31776","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:16.777707Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.967","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/pci/ctxfi/ctdaio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"950decf59d4e978b60a792ce0b3e1555a608f489","status":"affected","version":"a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16","versionType":"git"},{"lessThan":"b045ab3dff97edae6d538eeff900a34c098761f8","status":"affected","version":"a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/pci/ctxfi/ctdaio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix missing SPDIFI1 index handling\n\nSPDIF1 DAIO type isn't properly handled in daio_device_index() for\nhw20k2, and it returned -EINVAL, which ended up with the out-of-bounds\narray access.  Follow the hw20k1 pattern and return the proper index\nfor this type, too."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: ctxfi: Corrección del manejo faltante del índice SPDIFI1\n\nEl tipo DAIO SPDIF1 no se maneja correctamente en daio_device_index() para hw20k2, y devolvió -EINVAL, lo que resultó en el acceso a la matriz fuera de límites. Siga el patrón de hw20k1 y devuelva el índice adecuado también para este tipo."}],"id":"CVE-2026-31776","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31776","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:16.777707Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:40.967","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31777.json b/data/2026/CVE-2026-31777.json
index f253e3eacf..073bb45dac 100644
--- a/data/2026/CVE-2026-31777.json
+++ b/data/2026/CVE-2026-31777.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/pci/ctxfi/ctdaio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"971854e7b6ddda78669d3d0cf6566c7b8aca1fdb","status":"affected","version":"8cc72361481f00253f1e468ade5795427386d593","versionType":"git"},{"lessThan":"d4d3b8cbb70a2de247cbfe99bdb232aef9ed59bc","status":"affected","version":"8cc72361481f00253f1e468ade5795427386d593","versionType":"git"},{"lessThan":"277c6960d4ddb94d16198afd70c92c3d4593d131","status":"affected","version":"8cc72361481f00253f1e468ade5795427386d593","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/pci/ctxfi/ctdaio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B5A73A70-0997-4187-B1E3-6AF168E6E50F","versionEndExcluding":"6.19.12","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Check the error for index mapping\n\nThe ctxfi driver blindly assumed a proper value returned from\ndaio_device_index(), but it's not always true.  Add a proper error\ncheck to deal with the error from the function."}],"id":"CVE-2026-31777","lastModified":"2026-11-06T16:18:10.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31777","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:21.291325Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.087","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/277c6960d4ddb94d16198afd70c92c3d4593d131"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/971854e7b6ddda78669d3d0cf6566c7b8aca1fdb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d4d3b8cbb70a2de247cbfe99bdb232aef9ed59bc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/pci/ctxfi/ctdaio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"971854e7b6ddda78669d3d0cf6566c7b8aca1fdb","status":"affected","version":"8cc72361481f00253f1e468ade5795427386d593","versionType":"git"},{"lessThan":"d4d3b8cbb70a2de247cbfe99bdb232aef9ed59bc","status":"affected","version":"8cc72361481f00253f1e468ade5795427386d593","versionType":"git"},{"lessThan":"277c6960d4ddb94d16198afd70c92c3d4593d131","status":"affected","version":"8cc72361481f00253f1e468ade5795427386d593","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/pci/ctxfi/ctdaio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B5A73A70-0997-4187-B1E3-6AF168E6E50F","versionEndExcluding":"6.19.12","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Check the error for index mapping\n\nThe ctxfi driver blindly assumed a proper value returned from\ndaio_device_index(), but it's not always true.  Add a proper error\ncheck to deal with the error from the function."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: ctxfi: Comprobar el error para el mapeo de índices\n\nEl controlador ctxfi asumió ciegamente un valor adecuado devuelto por daio_device_index(), pero no siempre es cierto. Añadir una comprobación de error adecuada para manejar el error de la función."}],"id":"CVE-2026-31777","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31777","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:21.291325Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.087","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/277c6960d4ddb94d16198afd70c92c3d4593d131"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/971854e7b6ddda78669d3d0cf6566c7b8aca1fdb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d4d3b8cbb70a2de247cbfe99bdb232aef9ed59bc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31778.json b/data/2026/CVE-2026-31778.json
index ad0a62ca55..d83522946f 100644
--- a/data/2026/CVE-2026-31778.json
+++ b/data/2026/CVE-2026-31778.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"02d9c5b0b5553a391448b6d655262bd829f90234","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"66194c2575a4f567577ae70b1d7561163ce791a6","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"a82c1bce2d1299dd3c686a8fe48cf75b79a403c7","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"3178b62e2e31bab39f63d4c8e54bf4ee0a425627","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"3afa2e67f3523a980a2f90fd63c22322ac2b9ce0","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"7594a6464873d90fd229e5b94cdd3b92c9feabed","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"45424e871abf2a152e247a9cff78359f18dd95c0","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B50E0851-B870-41D9-8E6F-BA8182EF6CCB","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len < sizeof(card->id)` is used for the bounds check. Since\nsizeof(card->id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -> copy_valid_id_string(), the function scans\nforward with `while (*nid && ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n  BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n       sound/core/init.c:696 [inline]\n  BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n       sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card->id) - 1`,\nensuring at least one byte remains as the null terminator."}],"id":"CVE-2026-31778","lastModified":"2026-11-06T16:18:10.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31778","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:25.500479Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.190","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"02d9c5b0b5553a391448b6d655262bd829f90234","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"66194c2575a4f567577ae70b1d7561163ce791a6","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"a82c1bce2d1299dd3c686a8fe48cf75b79a403c7","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"3178b62e2e31bab39f63d4c8e54bf4ee0a425627","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"3afa2e67f3523a980a2f90fd63c22322ac2b9ce0","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"7594a6464873d90fd229e5b94cdd3b92c9feabed","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"},{"lessThan":"45424e871abf2a152e247a9cff78359f18dd95c0","status":"affected","version":"bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/caiaq/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B50E0851-B870-41D9-8E6F-BA8182EF6CCB","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len < sizeof(card->id)` is used for the bounds check. Since\nsizeof(card->id) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -> copy_valid_id_string(), the function scans\nforward with `while (*nid && ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n  BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n       sound/core/init.c:696 [inline]\n  BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n       sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card->id) - 1`,\nensuring at least one byte remains as the null terminator."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: caiaq: corrección de lectura fuera de límites de la pila en init_card\n\nEl bucle crea una copia del nombre corto de la tarjeta sin espacios en blanco donde se utiliza ’len < sizeof(card  ->  id)’ para la comprobación de límites. Dado que sizeof(card  ->  id) es 16 y el búfer de ID local también es de 16 bytes, escribir 16 caracteres que no son espacios llena todo el búfer, sobrescribiendo el byte nulo de terminación.\n\nCuando esta cadena no terminada en nulo se pasa más tarde a snd_card_set_id()   ->   copy_valid_id_string(), la función escanea hacia adelante con ’while (nid && ...)’ y lee más allá del final del búfer de la pila, leyendo el contenido de la pila.\n\nUn dispositivo USB con un nombre de producto que contenga muchos caracteres no ASCII y no espaciales (por ejemplo, UTF-8 multibyte) activará esto de forma fiable de la siguiente manera:\n\n  BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n       sound/core/init.c:696 [inline]\n  BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n       sound/core/init.c:718\n\nEl error de uno ha estado presente desde el commit bafeee5b1f8d (’ALSA: snd_usb_caiaq: give better shortname’) de junio de 2009 (v2.6.31-rc1), que introdujo por primera vez este bucle de eliminación de espacios en blanco. El código original nunca tuvo en cuenta el terminador nulo al limitar la copia.\n\nSolucione esto cambiando el límite del bucle a ’sizeof(card  ->  id) - 1’, asegurando que al menos un byte permanezca como el terminador nulo."}],"id":"CVE-2026-31778","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31778","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:25.500479Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.190","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31779.json b/data/2026/CVE-2026-31779.json
index cc7e1db021..8a3c3e0f7e 100644
--- a/data/2026/CVE-2026-31779.json
+++ b/data/2026/CVE-2026-31779.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f6abac936a0dfd31d6c3e49205ec0ee75a8f887f","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"ffbed27ba15ef80d1c622eeedbfef03e501ae134","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"e67d8c626ace80b0fa2b48c8ec0a46b508c93442","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"dd90880eb5ec5442b37eb2b95688f4a63f4883e3","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"744fabc338e87b95c4d1ff7c95bc8c0f834c6d99","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.1"},{"lessThan":"6.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D160CC79-0918-4708-9668-A084BD88B42B","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()\n\nThe memcpy function assumes the dynamic array notif->matches is at least\nas large as the number of bytes to copy. Otherwise, results->matches may\ncontain unwanted data. To guarantee safety, extend the validation in one\nof the checks to ensure sufficient packet length.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}],"id":"CVE-2026-31779","lastModified":"2026-10-19T20:17:59.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31779","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:14.151530Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/744fabc338e87b95c4d1ff7c95bc8c0f834c6d99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd90880eb5ec5442b37eb2b95688f4a63f4883e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e67d8c626ace80b0fa2b48c8ec0a46b508c93442"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6abac936a0dfd31d6c3e49205ec0ee75a8f887f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ffbed27ba15ef80d1c622eeedbfef03e501ae134"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f6abac936a0dfd31d6c3e49205ec0ee75a8f887f","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"ffbed27ba15ef80d1c622eeedbfef03e501ae134","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"e67d8c626ace80b0fa2b48c8ec0a46b508c93442","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"dd90880eb5ec5442b37eb2b95688f4a63f4883e3","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"},{"lessThan":"744fabc338e87b95c4d1ff7c95bc8c0f834c6d99","status":"affected","version":"5ac54afd4d97ad8d94fe250c83b1924eb6d2268c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.1"},{"lessThan":"6.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D160CC79-0918-4708-9668-A084BD88B42B","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()\n\nThe memcpy function assumes the dynamic array notif->matches is at least\nas large as the number of bytes to copy. Otherwise, results->matches may\ncontain unwanted data. To guarantee safety, extend the validation in one\nof the checks to ensure sufficient packet length.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: iwlwifi: mvm: corregir posible lectura fuera de límites en iwl_mvm_nd_match_info_handler()\n\nLa función memcpy asume que el array dinámico notif  ->  matches es al menos tan grande como el número de bytes a copiar. De lo contrario, results  ->  matches puede contener datos no deseados. Para garantizar la seguridad, extender la validación en una de las comprobaciones para asegurar una longitud de paquete suficiente.\n\nEncontrado por Linux Verification Center (linuxtesting.org) con SVACE."}],"id":"CVE-2026-31779","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31779","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:14.151530Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/744fabc338e87b95c4d1ff7c95bc8c0f834c6d99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd90880eb5ec5442b37eb2b95688f4a63f4883e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e67d8c626ace80b0fa2b48c8ec0a46b508c93442"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6abac936a0dfd31d6c3e49205ec0ee75a8f887f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ffbed27ba15ef80d1c622eeedbfef03e501ae134"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31780.json b/data/2026/CVE-2026-31780.json
index ce21d30f39..812b821c8d 100644
--- a/data/2026/CVE-2026-31780.json
+++ b/data/2026/CVE-2026-31780.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/microchip/wilc1000/hif.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"34a23fd9ddd683a03c7e8cc0ceded3e59e354b99","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"549f02d8ec94d39092ab6d9b103d0d6783a4b024","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"bfbddeadd4779651403035ee177ae2f22f9f5521","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"c97b2a00059608592ad0d86fbb813a4f8cf9464b","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"d8388614de613c28eeb659c10115060a83739924","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"0c7f21d8bd2f93998b72b7a7f93152336aeca4dd","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"d049e56b1739101d1c4d81deedb269c52a8dbba0","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/microchip/wilc1000/hif.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CC85AD7F-B910-43F1-9A7F-94BC2781DACB","versionEndExcluding":"5.10.253","versionStartIncluding":"4.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation\n\nThe variable valuesize is declared as u8 but accumulates the total\nlength of all SSIDs to scan. Each SSID contributes up to 33 bytes\n(IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10)\nSSIDs the total can reach 330, which wraps around to 74 when stored\nin a u8.\n\nThis causes kmalloc to allocate only 75 bytes while the subsequent\nmemcpy writes up to 331 bytes into the buffer, resulting in a 256-byte\nheap buffer overflow.\n\nWiden valuesize from u8 to u32 to accommodate the full range."}],"id":"CVE-2026-31780","lastModified":"2026-06-17T10:34:26.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:41.453","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c7f21d8bd2f93998b72b7a7f93152336aeca4dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34a23fd9ddd683a03c7e8cc0ceded3e59e354b99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/549f02d8ec94d39092ab6d9b103d0d6783a4b024"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfbddeadd4779651403035ee177ae2f22f9f5521"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c97b2a00059608592ad0d86fbb813a4f8cf9464b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d049e56b1739101d1c4d81deedb269c52a8dbba0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8388614de613c28eeb659c10115060a83739924"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/microchip/wilc1000/hif.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"34a23fd9ddd683a03c7e8cc0ceded3e59e354b99","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"549f02d8ec94d39092ab6d9b103d0d6783a4b024","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"bfbddeadd4779651403035ee177ae2f22f9f5521","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"c97b2a00059608592ad0d86fbb813a4f8cf9464b","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"d8388614de613c28eeb659c10115060a83739924","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"0c7f21d8bd2f93998b72b7a7f93152336aeca4dd","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"},{"lessThan":"d049e56b1739101d1c4d81deedb269c52a8dbba0","status":"affected","version":"c5c77ba18ea66aa05441c71e38473efb787705a4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/microchip/wilc1000/hif.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CC85AD7F-B910-43F1-9A7F-94BC2781DACB","versionEndExcluding":"5.10.253","versionStartIncluding":"4.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation\n\nThe variable valuesize is declared as u8 but accumulates the total\nlength of all SSIDs to scan. Each SSID contributes up to 33 bytes\n(IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10)\nSSIDs the total can reach 330, which wraps around to 74 when stored\nin a u8.\n\nThis causes kmalloc to allocate only 75 bytes while the subsequent\nmemcpy writes up to 331 bytes into the buffer, resulting in a 256-byte\nheap buffer overflow.\n\nWiden valuesize from u8 to u32 to accommodate the full range."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: wilc1000: corregir desbordamiento de u8 en el cálculo del tamaño del búfer de escaneo de SSID\n\nLa variable valuesize está declarada como u8 pero acumula la longitud total de todos los SSIDs a escanear. Cada SSID contribuye con hasta 33 bytes (IEEE80211_MAX_SSID_LEN + 1), y con WILC_MAX_NUM_PROBED_SSID (10) SSIDs el total puede alcanzar 330, lo que se envuelve a 74 cuando se almacena en un u8.\n\nEsto hace que kmalloc asigne solo 75 bytes mientras que el memcpy subsiguiente escribe hasta 331 bytes en el búfer, lo que resulta en un desbordamiento de búfer de pila de 256 bytes.\n\nAmpliar valuesize de u8 a u32 para acomodar el rango completo."}],"id":"CVE-2026-31780","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:41.453","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c7f21d8bd2f93998b72b7a7f93152336aeca4dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34a23fd9ddd683a03c7e8cc0ceded3e59e354b99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/549f02d8ec94d39092ab6d9b103d0d6783a4b024"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfbddeadd4779651403035ee177ae2f22f9f5521"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c97b2a00059608592ad0d86fbb813a4f8cf9464b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d049e56b1739101d1c4d81deedb269c52a8dbba0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8388614de613c28eeb659c10115060a83739924"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31781.json b/data/2026/CVE-2026-31781.json
index 938e08c6a9..3f3b6c0f5e 100644
--- a/data/2026/CVE-2026-31781.json
+++ b/data/2026/CVE-2026-31781.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_ioc32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"46a60ee8956ef1975f00455f614761c7ecedc09d","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"5bb398991f378ef74d90b14a6ea8b61ff96cc03a","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"d59c5d8539662d95887b4564f3f72ad38076a2d5","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"489f2ef2b908898d01df697dc4fe1476674be640","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"4a41c2b18fc05d30b718d2602cac339eae710b34","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"f0e441be08a2eab10b2d06fccfa267ee599dd6b3","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"27ef84bba9b9d7b03418c60fbc6069ea0e87b13c","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"f8995c2df519f382525ca4bc90553ad2ec611067","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"status":"affected","version":"abc60edcfc87771ff244763d4d19c67766f5dd0f","versionType":"git"},{"status":"affected","version":"a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663","versionType":"git"},{"status":"affected","version":"00279b505289f7529d9be2e78915d0483ffbd314","versionType":"git"},{"status":"affected","version":"d04e6ea0cec9e7d6cba806508f657d2d0dc6cacf","versionType":"git"},{"status":"affected","version":"7f3ebea19795eb38438cd3709fabf2afd53cf447","versionType":"git"},{"lessThan":"3.17","status":"affected","version":"3.16.63","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.170","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.148","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.91","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.13","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/drm_ioc32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"397E9355-802C-42FB-9D2D-91CFA8EA9AD2","versionEndExcluding":"3.17","versionStartIncluding":"3.16.63","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6D2CF938-4FA1-416D-AC49-F221731F57ED","versionEndExcluding":"4.5","versionStartIncluding":"4.4.170","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"33F3E0D4-C480-40A1-A07F-D8A3FCA24950","versionEndExcluding":"4.10","versionStartIncluding":"4.9.148","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5D7F3172-4AC1-481C-9E21-1366A469147F","versionEndExcluding":"4.15","versionStartIncluding":"4.14.91","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9405B32A-678E-4CD1-94D3-4FBB7DD0430F","versionEndExcluding":"4.20","versionStartIncluding":"4.19.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"99763E34-9798-4EED-94CE-E0AFF0E63F37","versionEndExcluding":"5.10.253","versionStartIncluding":"4.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*","matchCriteriaId":"1072305B-94A8-4D68-9419-B786885AA310","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function pointers, the signature method\nof spectre problems.  Fix this up by calling array_index_nospec() on the\nindex to the function pointer list."}],"id":"CVE-2026-31781","lastModified":"2026-11-06T16:18:10.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31781","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:30.387022Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f8995c2df519f382525ca4bc90553ad2ec611067"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_ioc32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"46a60ee8956ef1975f00455f614761c7ecedc09d","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"5bb398991f378ef74d90b14a6ea8b61ff96cc03a","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"d59c5d8539662d95887b4564f3f72ad38076a2d5","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"489f2ef2b908898d01df697dc4fe1476674be640","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"4a41c2b18fc05d30b718d2602cac339eae710b34","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"f0e441be08a2eab10b2d06fccfa267ee599dd6b3","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"27ef84bba9b9d7b03418c60fbc6069ea0e87b13c","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"lessThan":"f8995c2df519f382525ca4bc90553ad2ec611067","status":"affected","version":"505b5240329b922f21f91d5b5d1e535c805eca6d","versionType":"git"},{"status":"affected","version":"abc60edcfc87771ff244763d4d19c67766f5dd0f","versionType":"git"},{"status":"affected","version":"a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663","versionType":"git"},{"status":"affected","version":"00279b505289f7529d9be2e78915d0483ffbd314","versionType":"git"},{"status":"affected","version":"d04e6ea0cec9e7d6cba806508f657d2d0dc6cacf","versionType":"git"},{"status":"affected","version":"7f3ebea19795eb38438cd3709fabf2afd53cf447","versionType":"git"},{"lessThan":"3.17","status":"affected","version":"3.16.63","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.170","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.148","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.91","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.13","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/drm_ioc32.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"397E9355-802C-42FB-9D2D-91CFA8EA9AD2","versionEndExcluding":"3.17","versionStartIncluding":"3.16.63","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6D2CF938-4FA1-416D-AC49-F221731F57ED","versionEndExcluding":"4.5","versionStartIncluding":"4.4.170","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"33F3E0D4-C480-40A1-A07F-D8A3FCA24950","versionEndExcluding":"4.10","versionStartIncluding":"4.9.148","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5D7F3172-4AC1-481C-9E21-1366A469147F","versionEndExcluding":"4.15","versionStartIncluding":"4.14.91","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9405B32A-678E-4CD1-94D3-4FBB7DD0430F","versionEndExcluding":"4.20","versionStartIncluding":"4.19.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"99763E34-9798-4EED-94CE-E0AFF0E63F37","versionEndExcluding":"5.10.253","versionStartIncluding":"4.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*","matchCriteriaId":"1072305B-94A8-4D68-9419-B786885AA310","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function pointers, the signature method\nof spectre problems.  Fix this up by calling array_index_nospec() on the\nindex to the function pointer list."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/ioc32: detener la especulación en la ruta drm_compat_ioctl\n\nLa ruta drm compat ioctl toma un puntero controlado por el usuario y luego lo desreferencia en una tabla de punteros de función, el método característico de los problemas de Spectre. Soluciona esto llamando a array_index_nospec() en el índice de la lista de punteros de función."}],"id":"CVE-2026-31781","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31781","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:30.387022Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f8995c2df519f382525ca4bc90553ad2ec611067"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31782.json b/data/2026/CVE-2026-31782.json
index 570cab3342..ea728699fa 100644
--- a/data/2026/CVE-2026-31782.json
+++ b/data/2026/CVE-2026-31782.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/events/intel/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e435a30ca6fe14c9611b1fc731c98a6d28410247","status":"affected","version":"ec980e4facef8110f6fce27e5b6344660117f01f","versionType":"git"},{"lessThan":"bfee04838f636d064bc92075c65c95f739003804","status":"affected","version":"ec980e4facef8110f6fce27e5b6344660117f01f","versionType":"git"},{"lessThan":"dbde07f06226438cd2cf1179745fa1bec5d8914a","status":"affected","version":"ec980e4facef8110f6fce27e5b6344660117f01f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/events/intel/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A373E4BD-44BD-4FB8-8A1D-03D3759ABECA","versionEndExcluding":"6.18.22","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86: Fix potential bad container_of in intel_pmu_hw_config\n\nAuto counter reload may have a group of events with software events\npresent within it. The software event PMU isn't the x86_hybrid_pmu and\na container_of operation in intel_pmu_set_acr_caused_constr (via the\nhybrid helper) could cause out of bound memory reads. Avoid this by\nguarding the call to intel_pmu_set_acr_caused_constr with an\nis_x86_event check."}],"id":"CVE-2026-31782","lastModified":"2026-06-17T10:34:27.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:41.707","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfee04838f636d064bc92075c65c95f739003804"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dbde07f06226438cd2cf1179745fa1bec5d8914a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e435a30ca6fe14c9611b1fc731c98a6d28410247"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/events/intel/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e435a30ca6fe14c9611b1fc731c98a6d28410247","status":"affected","version":"ec980e4facef8110f6fce27e5b6344660117f01f","versionType":"git"},{"lessThan":"bfee04838f636d064bc92075c65c95f739003804","status":"affected","version":"ec980e4facef8110f6fce27e5b6344660117f01f","versionType":"git"},{"lessThan":"dbde07f06226438cd2cf1179745fa1bec5d8914a","status":"affected","version":"ec980e4facef8110f6fce27e5b6344660117f01f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/events/intel/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A373E4BD-44BD-4FB8-8A1D-03D3759ABECA","versionEndExcluding":"6.18.22","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86: Fix potential bad container_of in intel_pmu_hw_config\n\nAuto counter reload may have a group of events with software events\npresent within it. The software event PMU isn't the x86_hybrid_pmu and\na container_of operation in intel_pmu_set_acr_caused_constr (via the\nhybrid helper) could cause out of bound memory reads. Avoid this by\nguarding the call to intel_pmu_set_acr_caused_constr with an\nis_x86_event check."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nperf/x86: Corregir un potencial ’container_of’ incorrecto en ’intel_pmu_hw_config’\n\nLa recarga automática del contador puede tener un grupo de eventos con eventos de software presentes en él. La PMU de eventos de software no es la ’x86_hybrid_pmu’ y una operación ’container_of’ en ’intel_pmu_set_acr_caused_constr’ (a través del asistente híbrido) podría causar lecturas de memoria fuera de límites. Evitar esto protegiendo la llamada a ’intel_pmu_set_acr_caused_constr’ con una verificación ’is_x86_event’."}],"id":"CVE-2026-31782","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-01T15:16:41.707","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfee04838f636d064bc92075c65c95f739003804"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dbde07f06226438cd2cf1179745fa1bec5d8914a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e435a30ca6fe14c9611b1fc731c98a6d28410247"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-31786.json b/data/2026/CVE-2026-31786.json
index e2ec350c74..d78b7570ea 100644
--- a/data/2026/CVE-2026-31786.json
+++ b/data/2026/CVE-2026-31786.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/xen/sys-hypervisor.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e3af585e1728c917682b6a3de9a69b41fb9194d4","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"8288d031a01dbacfde3fc643f7be3d23504de64d","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"f458ba102da97fafca106327086fc95f3fc764cb","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"4b4defd2fce3f966c25adabf46644a85558f1169","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"d5f59216650c51e5e3fcb7517c825bc8047f60ef","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"52cecff98bda2c51eed1c6ce9d21c5d6268fb19d","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"27fdbab4221b375de54bf91919798d88520c6e28","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/xen/sys-hypervisor.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.13"},{"lessThan":"4.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.137","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.85","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.26","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1493839B-26E7-4663-8942-B55262171032","versionEndExcluding":"5.10.254","versionStartIncluding":"4.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3EF52-168A-4348-8F5F-356C9EB69261","versionEndExcluding":"6.6.137","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F17D292D-A9B5-4DC7-8002-51AB95335606","versionEndExcluding":"6.12.85","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85751F83-26BA-498C-90E7-E38A59C4564D","versionEndExcluding":"6.18.26","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7C9A567-4F4F-4C61-BAD3-440B34C67118","versionEndExcluding":"7.0.3","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBuffer overflow in drivers/xen/sys-hypervisor.c\n\nThe build id returned by HYPERVISOR_xen_version(XENVER_build_id) is\nneither NUL terminated nor a string.\n\nThe first causes a buffer overflow as sprintf in buildid_show will\nread and copy till it finds a NUL.\n\n00000000  f4 91 51 f4 dd 38 9e 9d  65 47 52 eb 10 71 db 50  |..Q..8..eGR..q.P|\n00000010  b9 a8 01 42 6f 2e 32                              |...Bo.2|\n00000017\n\nSo use a memcpy instead of sprintf to have the correct value:\n\n00000000  f4 91 51 f4 dd 00 9e 9d  65 47 52 eb 10 71 db 50  |..Q.....eGR..q.P|\n00000010  b9 a8 01 42                                       |...B|\n00000014\n\n(the above have a hack to embed a zero inside and check it's\nreturned correctly).\n\nThis is XSA-485 / CVE-2026-31786"}],"id":"CVE-2026-31786","lastModified":"2026-10-19T20:17:59.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31786","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:16.479800Z","version":"2.0.3"}}]},"published":"2026-04-30T11:16:20.967","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27fdbab4221b375de54bf91919798d88520c6e28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b4defd2fce3f966c25adabf46644a85558f1169"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52cecff98bda2c51eed1c6ce9d21c5d6268fb19d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8288d031a01dbacfde3fc643f7be3d23504de64d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5f59216650c51e5e3fcb7517c825bc8047f60ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3af585e1728c917682b6a3de9a69b41fb9194d4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f458ba102da97fafca106327086fc95f3fc764cb"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/04/28/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://xenbits.xen.org/xsa/advisory-485.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-120"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/xen/sys-hypervisor.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e3af585e1728c917682b6a3de9a69b41fb9194d4","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"8288d031a01dbacfde3fc643f7be3d23504de64d","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"f458ba102da97fafca106327086fc95f3fc764cb","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"4b4defd2fce3f966c25adabf46644a85558f1169","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"d5f59216650c51e5e3fcb7517c825bc8047f60ef","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"52cecff98bda2c51eed1c6ce9d21c5d6268fb19d","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"},{"lessThan":"27fdbab4221b375de54bf91919798d88520c6e28","status":"affected","version":"84b7625728ea311ea35bdaa0eded53c1c56baeaa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/xen/sys-hypervisor.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.13"},{"lessThan":"4.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.137","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.85","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.26","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1493839B-26E7-4663-8942-B55262171032","versionEndExcluding":"5.10.254","versionStartIncluding":"4.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3EF52-168A-4348-8F5F-356C9EB69261","versionEndExcluding":"6.6.137","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F17D292D-A9B5-4DC7-8002-51AB95335606","versionEndExcluding":"6.12.85","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85751F83-26BA-498C-90E7-E38A59C4564D","versionEndExcluding":"6.18.26","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7C9A567-4F4F-4C61-BAD3-440B34C67118","versionEndExcluding":"7.0.3","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBuffer overflow in drivers/xen/sys-hypervisor.c\n\nThe build id returned by HYPERVISOR_xen_version(XENVER_build_id) is\nneither NUL terminated nor a string.\n\nThe first causes a buffer overflow as sprintf in buildid_show will\nread and copy till it finds a NUL.\n\n00000000  f4 91 51 f4 dd 38 9e 9d  65 47 52 eb 10 71 db 50  |..Q..8..eGR..q.P|\n00000010  b9 a8 01 42 6f 2e 32                              |...Bo.2|\n00000017\n\nSo use a memcpy instead of sprintf to have the correct value:\n\n00000000  f4 91 51 f4 dd 00 9e 9d  65 47 52 eb 10 71 db 50  |..Q.....eGR..q.P|\n00000010  b9 a8 01 42                                       |...B|\n00000014\n\n(the above have a hack to embed a zero inside and check it's\nreturned correctly).\n\nThis is XSA-485 / CVE-2026-31786"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nDesbordamiento de búfer en drivers/xen/sys-hypervisor.c\n\nEl ID de compilación devuelto por HYPERVISOR_xen_version(XENVER_build_id) no está terminado en NUL ni es una cadena.\n\nEl primero causa un desbordamiento de búfer ya que sprintf en buildid_show leerá y copiará hasta que encuentre un NUL.\n\n00000000  f4 91 51 f4 dd 38 9e 9d  65 47 52 eb 10 71 db 50  |..Q..8..eGR..q.P|\n00000010  b9 a8 01 42 6f 2e 32                              |...Bo.2|\n00000017\n\nAsí que use un memcpy en lugar de sprintf para tener el valor correcto:\n\n00000000  f4 91 51 f4 dd 00 9e 9d  65 47 52 eb 10 71 db 50  |..Q.....eGR..q.P|\n00000010  b9 a8 01 42                                       |...B|\n00000014\n\n(lo anterior tiene un truco para incrustar un cero dentro y verificar que se devuelve correctamente).\n\nEsto es XSA-485 / CVE-2026-31786"}],"id":"CVE-2026-31786","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31786","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:13:16.479800Z","version":"2.0.3"}}]},"published":"2026-04-30T11:16:20.967","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27fdbab4221b375de54bf91919798d88520c6e28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b4defd2fce3f966c25adabf46644a85558f1169"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52cecff98bda2c51eed1c6ce9d21c5d6268fb19d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c5ff7c7bd15bb536f44b10b3fb5b8408f344d0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8288d031a01dbacfde3fc643f7be3d23504de64d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5f59216650c51e5e3fcb7517c825bc8047f60ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3af585e1728c917682b6a3de9a69b41fb9194d4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f458ba102da97fafca106327086fc95f3fc764cb"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/04/28/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://xenbits.xen.org/xsa/advisory-485.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-120"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-31787.json b/data/2026/CVE-2026-31787.json
index b3cb931515..41f23d61c5 100644
--- a/data/2026/CVE-2026-31787.json
+++ b/data/2026/CVE-2026-31787.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/xen/privcmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dbf862ce9f009128ab86b234d91413a3e450beb4","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"2b985d3a024b9e8c24e21671b34e855569763808","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"1576ff3869cbd3620717195f971c85b7d7fd62b5","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"402d84ad9e89bd4cbfd07ca8598532b7021daf95","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"2894a351fe2ea8684919d36df3188b9a35e3926f","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"446ee446d9ae66f36e95c3c90bbcc4e56b94cde0","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"71bf829800758a6e3889096e4754ef47ba7fc850","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"24daca4fc07f3ff8cd0e3f629cd982187f48436a","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/xen/privcmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.8"},{"lessThan":"3.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.137","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.85","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.26","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3DE3234F-8A05-4247-9F10-5D657450C37A","versionEndExcluding":"5.10.254","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3EF52-168A-4348-8F5F-356C9EB69261","versionEndExcluding":"6.6.137","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F17D292D-A9B5-4DC7-8002-51AB95335606","versionEndExcluding":"6.12.85","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85751F83-26BA-498C-90E7-E38A59C4564D","versionEndExcluding":"6.18.26","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7C9A567-4F4F-4C61-BAD3-440B34C67118","versionEndExcluding":"7.0.3","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() on a privcmd mapping,\nthe kernel splits the VMA via __split_vma(). Since may_split is NULL,\nthe split is allowed. vm_area_dup() copies vm_private_data (a pages\narray allocated in alloc_empty_pages()) into the new VMA without any\nfixup, because there is no .open callback.\n\nBoth VMAs now point to the same pages array. When the unmapped portion\nis closed, privcmd_close() calls:\n    - xen_unmap_domain_gfn_range()\n    - xen_free_unpopulated_pages()\n    - kvfree(pages)\n\nThe surviving VMA still holds the dangling pointer. When it is later\ndestroyed, the same sequence runs again, which leads to a double free.\n\nFix this issue by adding a .may_split callback denying the VMA split.\n\nThis is XSA-487 / CVE-2026-31787"}],"id":"CVE-2026-31787","lastModified":"2026-11-06T16:18:11.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:39.751360Z","version":"2.0.3"}}]},"published":"2026-04-30T11:16:21.087","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/04/28/14"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"http://xenbits.xen.org/xsa/advisory-487.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/xen/privcmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dbf862ce9f009128ab86b234d91413a3e450beb4","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"2b985d3a024b9e8c24e21671b34e855569763808","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"1576ff3869cbd3620717195f971c85b7d7fd62b5","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"402d84ad9e89bd4cbfd07ca8598532b7021daf95","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"2894a351fe2ea8684919d36df3188b9a35e3926f","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"446ee446d9ae66f36e95c3c90bbcc4e56b94cde0","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"71bf829800758a6e3889096e4754ef47ba7fc850","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"},{"lessThan":"24daca4fc07f3ff8cd0e3f629cd982187f48436a","status":"affected","version":"d71f513985c22f1050295d1a7e4327cf9fb060da","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/xen/privcmd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.8"},{"lessThan":"3.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.137","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.85","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.26","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3DE3234F-8A05-4247-9F10-5D657450C37A","versionEndExcluding":"5.10.254","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3EF52-168A-4348-8F5F-356C9EB69261","versionEndExcluding":"6.6.137","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F17D292D-A9B5-4DC7-8002-51AB95335606","versionEndExcluding":"6.12.85","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85751F83-26BA-498C-90E7-E38A59C4564D","versionEndExcluding":"6.18.26","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7C9A567-4F4F-4C61-BAD3-440B34C67118","versionEndExcluding":"7.0.3","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","matchCriteriaId":"B1EF7059-E670-45F4-B422-54C40FA86390","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","matchCriteriaId":"0D38F0BF-A728-4133-A358-D44A2F7EE6D6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxen/privcmd: fix double free via VMA splitting\n\nprivcmd_vm_ops defines .close (privcmd_close), but neither .may_split\nnor .open. When userspace does a partial munmap() on a privcmd mapping,\nthe kernel splits the VMA via __split_vma(). Since may_split is NULL,\nthe split is allowed. vm_area_dup() copies vm_private_data (a pages\narray allocated in alloc_empty_pages()) into the new VMA without any\nfixup, because there is no .open callback.\n\nBoth VMAs now point to the same pages array. When the unmapped portion\nis closed, privcmd_close() calls:\n    - xen_unmap_domain_gfn_range()\n    - xen_free_unpopulated_pages()\n    - kvfree(pages)\n\nThe surviving VMA still holds the dangling pointer. When it is later\ndestroyed, the same sequence runs again, which leads to a double free.\n\nFix this issue by adding a .may_split callback denying the VMA split.\n\nThis is XSA-487 / CVE-2026-31787"},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nxen/privcmd: corrige doble liberación a través de la división de VMA\n\nprivcmd_vm_ops define .close (privcmd_close), pero ni .may_split ni .open. Cuando el espacio de usuario realiza un munmap() parcial en un mapeo de privcmd, el kernel divide el VMA a través de __split_vma(). Dado que may_split es NULL, se permite la división. vm_area_dup() copia vm_private_data (un array de páginas asignado en alloc_empty_pages()) en el nuevo VMA sin ninguna corrección, porque no hay una devolución de llamada .open.\n\nAmbos VMA ahora apuntan al mismo array de páginas. Cuando la porción desmapeada se cierra, privcmd_close() llama a:\n    - xen_unmap_domain_gfn_range()\n    - xen_free_unpopulated_pages()\n    - kvfree(pages)\n\nEl VMA superviviente aún mantiene el puntero colgante. Cuando se destruye más tarde, la misma secuencia se ejecuta de nuevo, lo que lleva a una doble liberación.\n\nSolucione este problema añadiendo una devolución de llamada .may_split que deniegue la división del VMA.\n\nEsto es XSA-487 / CVE-2026-31787"}],"id":"CVE-2026-31787","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:39.751360Z","version":"2.0.3"}}]},"published":"2026-04-30T11:16:21.087","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1576ff3869cbd3620717195f971c85b7d7fd62b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24daca4fc07f3ff8cd0e3f629cd982187f48436a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2894a351fe2ea8684919d36df3188b9a35e3926f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b985d3a024b9e8c24e21671b34e855569763808"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/402d84ad9e89bd4cbfd07ca8598532b7021daf95"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/446ee446d9ae66f36e95c3c90bbcc4e56b94cde0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71bf829800758a6e3889096e4754ef47ba7fc850"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dbf862ce9f009128ab86b234d91413a3e450beb4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/04/28/14"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"http://xenbits.xen.org/xsa/advisory-487.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-35051.json b/data/2026/CVE-2026-35051.json
index 16bffbf459..e4e61ea65d 100644
--- a/data/2026/CVE-2026-35051.json
+++ b/data/2026/CVE-2026-35051.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.0.0-beta1, < 3.6.14"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779786779","versionType":"rpm"}]}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."}],"id":"CVE-2026-35051","lastModified":"2026-07-15T02:20:40.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35051","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T21:19:58.832533Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:32.047","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-35051"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464235"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35051.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-501"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.0.0-beta1, < 3.6.14"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779786779","versionType":"rpm"}]}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false is configured and Traefik is deployed behind a trusted upstream proxy. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."},{"lang":"es","value":"Traefik es un proxy inverso HTTP y un balanceador de carga. Antes de las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2, existe una vulnerabilidad de omisión de autenticación en el middleware ForwardAuth de Traefik cuando trustForwardHeader=false está configurado y Traefik se despliega detrás de un proxy ascendente de confianza. Este problema ha sido parcheado en las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2."}],"id":"CVE-2026-35051","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35051","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T21:19:58.832533Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:32.047","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-6384-m2mw-rf54"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-35051"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464235"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35051.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-501"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-35547.json b/data/2026/CVE-2026-35547.json
index de818ae07e..4889f8daa8 100644
--- a/data/2026/CVE-2026-35547.json
+++ b/data/2026/CVE-2026-35547.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["libnv"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"When processing the header of an incoming message, libnv failed to properly validate the message size.\n\nThe lack of validation allows a malicious program to write outside the bounds of a heap allocation.  This can trigger a crash or system panic, and it may be possible for an unprivileged user to exploit the bug to elevate their privileges."}],"id":"CVE-2026-35547","lastModified":"2026-06-17T10:40:45.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T03:55:50.905074Z","version":"2.0.3"}}]},"published":"2026-04-30T09:16:03.167","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:17.libnv.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-130"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["libnv"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"When processing the header of an incoming message, libnv failed to properly validate the message size.\n\nThe lack of validation allows a malicious program to write outside the bounds of a heap allocation.  This can trigger a crash or system panic, and it may be possible for an unprivileged user to exploit the bug to elevate their privileges."},{"lang":"es","value":"Al procesar la cabecera de un mensaje entrante, libnv no validó correctamente el tamaño del mensaje. La falta de validación permite a un programa malicioso escribir fuera de los límites de una asignación de heap. Esto puede desencadenar una caída o un pánico del sistema, y puede ser posible para un usuario no privilegiado realizar un exploit del error para elevar sus privilegios."}],"id":"CVE-2026-35547","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T03:55:50.905074Z","version":"2.0.3"}}]},"published":"2026-04-30T09:16:03.167","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:17.libnv.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"},{"lang":"en","value":"CWE-130"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-37555.json b/data/2026/CVE-2026-37555.json
index da9ea7423e..78a712312c 100644
--- a/data/2026/CVE-2026-37555.json
+++ b/data/2026/CVE-2026-37555.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.2-6.el10_2.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.2-5.el10_0.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-17.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-10.el8_4.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-10.el8_4.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-13.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.6"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-13.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-14.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-14.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.31-9.el9_8.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.31-7.el9_2.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.31-8.el9_4.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.31-9.el9_6.1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782352950","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782352919","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782353093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782352847","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unknown","packageName":"libsndfile","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unknown","packageName":"libsndfile","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:libsndfile_project:libsndfile:1.2.2:*:*:*:*:*:*:*","matchCriteriaId":"4B4A418B-ABB5-4873-B762-D717D6FB9232","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065."}],"id":"CVE-2026-37555","lastModified":"2026-07-15T02:20:44.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37555","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:31:33.669309Z","version":"2.0.3"}}]},"published":"2026-04-29T16:16:23.410","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1"},{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151"},{"source":"cve@mitre.org","tags":["Issue Tracking"],"url":"https://github.com/libsndfile/libsndfile/issues/833"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19559"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19560"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19610"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23221"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23222"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23223"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25092"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25197"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25198"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25227"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30078"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30087"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-37555"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463856"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking"],"url":"https://github.com/libsndfile/libsndfile/issues/833"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.2-6.el10_2.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.2-5.el10_0.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-17.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-10.el8_4.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-10.el8_4.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-13.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.6"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-13.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-14.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.28-14.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.31-9.el9_8.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.31-7.el9_2.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.31-8.el9_4.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"libsndfile","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.31-9.el9_6.1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782352950","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782352919","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782353093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782352847","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unknown","packageName":"libsndfile","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unknown","packageName":"libsndfile","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:libsndfile_project:libsndfile:1.2.2:*:*:*:*:*:*:*","matchCriteriaId":"4B4A418B-ABB5-4873-B762-D717D6FB9232","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065."},{"lang":"es","value":"Se descubrió un problema en el códec IMA ADPCM de libsndfile 1.2.2. La ruta de código AIFF (línea 241) se corrigió con una conversión (cast) a (sf_count_t), pero la ruta de código WAV (línea 235) y la ruta de cierre (línea 167) no lo fueron. Cuando samplesperblock (int) * blocks (int) excede INT_MAX, la multiplicación de 32 bits se desborda antes de ser asignada a sf.frames (sf_count_t/int64). Con samplesperblock=50000 y blocks=50000, el producto 2500000000 se desborda a -1794967296. Esto causa un recuento de fotogramas incorrecto, lo que lleva a un desbordamiento de búfer de pila o denegación de servicio. Ambos valores provienen del encabezado del archivo WAV y son controlados por el atacante. Este problema fue descubierto después de una corrección incompleta para CVE-2022-33065."}],"id":"CVE-2026-37555","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37555","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:31:33.669309Z","version":"2.0.3"}}]},"published":"2026-04-29T16:16:23.410","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1"},{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151"},{"source":"cve@mitre.org","tags":["Issue Tracking"],"url":"https://github.com/libsndfile/libsndfile/issues/833"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19559"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19560"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19610"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23221"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23222"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23223"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25092"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25197"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25198"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25227"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30078"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30087"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-37555"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463856"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking"],"url":"https://github.com/libsndfile/libsndfile/issues/833"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-39103.json b/data/2026/CVE-2026-39103.json
index 6d5a838f80..2605d39b21 100644
--- a/data/2026/CVE-2026-39103.json
+++ b/data/2026/CVE-2026-39103.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*","matchCriteriaId":"DF3A6E0C-CE62-44A2-8507-35193465BD8E","versionEndExcluding":"2026-04-01","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_attributes.c, svg_parse_strings(), gf_svg_parse_attribute()"}],"id":"CVE-2026-39103","lastModified":"2026-06-17T10:41:50.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39103","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-06T18:32:49.023340Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:12.993","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/gpac/gpac/commit/391dc7f4d234988ea0bc3cc294eb725eddf8f702"},{"source":"cve@mitre.org","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://github.com/gpac/gpac/issues/3506"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://github.com/gpac/gpac/issues/3506"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*","matchCriteriaId":"DF3A6E0C-CE62-44A2-8507-35193465BD8E","versionEndExcluding":"2026-04-01","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_attributes.c, svg_parse_strings(), gf_svg_parse_attribute()"},{"lang":"es","value":"Vulnerabilidad de desbordamiento de búfer en GPAC antes del commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 permite a un atacante causar una denegación de servicio a través de src/scenegraph/svg_attributes.c, svg_parse_strings(), gf_svg_parse_attribute()"}],"id":"CVE-2026-39103","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39103","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-06T18:32:49.023340Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:12.993","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/gpac/gpac/commit/391dc7f4d234988ea0bc3cc294eb725eddf8f702"},{"source":"cve@mitre.org","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://github.com/gpac/gpac/issues/3506"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://github.com/gpac/gpac/issues/3506"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-39457.json b/data/2026/CVE-2026-39457.json
index de47b66e37..f9ce47dc12 100644
--- a/data/2026/CVE-2026-39457.json
+++ b/data/2026/CVE-2026-39457.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["libnv"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"When exchanging data over a socket, libnv uses select(2) to wait for data to arrive.  However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024).\n\nAn attacker who is able to force a libnv application to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, can trigger stack corruption.  If the target application is setuid-root, then this could be used to elevate local privileges."}],"id":"CVE-2026-39457","lastModified":"2026-06-17T10:42:07.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39457","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-30T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-30T09:16:03.270","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:16.libnv.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["libnv"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"When exchanging data over a socket, libnv uses select(2) to wait for data to arrive.  However, it does not verify whether the provided socket descriptor fits in select(2)'s file descriptor set size limit of FD_SETSIZE (1024).\n\nAn attacker who is able to force a libnv application to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, can trigger stack corruption.  If the target application is setuid-root, then this could be used to elevate local privileges."},{"lang":"es","value":"Al intercambiar datos a través de un socket, libnv utiliza select(2) para esperar la llegada de datos. Sin embargo, no verifica si el descriptor de socket proporcionado cabe en el límite de tamaño del conjunto de descriptores de archivo de select(2) de FD_SETSIZE (1024).\n\nUn atacante que es capaz de forzar a una aplicación libnv a asignar descriptores de archivo grandes, por ejemplo, abriendo muchos descriptores y ejecutando un programa que no tiene cuidado de cerrarlos al inicio, puede desencadenar corrupción de pila. Si la aplicación objetivo es setuid-root, entonces esto podría usarse para elevar privilegios locales."}],"id":"CVE-2026-39457","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39457","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-30T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-30T09:16:03.270","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:16.libnv.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-39858.json b/data/2026/CVE-2026-39858.json
index f3332a299f..acb3a72395 100644
--- a/data/2026/CVE-2026-39858.json
+++ b/data/2026/CVE-2026-39858.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.0.0-beta1, < 3.6.14"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779786779","versionType":"rpm"}]}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."}],"id":"CVE-2026-39858","lastModified":"2026-07-15T02:20:53.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39858","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-04T16:57:57.062955Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:32.313","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-39858"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464234"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39858.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-289"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.0.0-beta1, < 3.6.14"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779786779","versionType":"rpm"}]}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."},{"lang":"es","value":"Traefik es un proxy inverso HTTP y un balanceador de carga. Antes de las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2, existe una vulnerabilidad de omisión de autenticación de alta gravedad en el middleware de autenticación ForwardAuth y basado en snippets de Traefik. La lógica de saneamiento de encabezados reenviados de Traefik se dirige solo a nombres de encabezado canónicos (por ejemplo, X-Forwarded-Proto) y no elimina ni normaliza variantes de alias que usan guiones bajos en lugar de guiones (por ejemplo, X_Forwarded_Proto). Estos encabezados de alias no saneados se reenvían intactos al backend de autenticación. Cuando el backend normaliza las formas de encabezado con guiones bajos y guiones de manera equivalente, un atacante puede inyectar contexto de confianza falsificado - como un esquema o host de confianza - a través de los encabezados de alias y omitir la autenticación en rutas protegidas sin credenciales válidas. Este problema ha sido parcheado en las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2."}],"id":"CVE-2026-39858","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39858","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-04T16:57:57.062955Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:32.313","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-39858"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464234"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39858.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-289"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-40684.json b/data/2026/CVE-2026-40684.json
index 1b0ff25047..6e35d06073 100644
--- a/data/2026/CVE-2026-40684.json
+++ b/data/2026/CVE-2026-40684.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Exim","vendor":"Exim","versions":[{"lessThan":"4.99.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","matchCriteriaId":"E48EAA99-95DA-4695-BBEA-16D09AA0A508","versionEndExcluding":"4.99.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing."}],"id":"CVE-2026-40684","lastModified":"2026-06-17T10:45:34.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:25:46.779854Z","version":"2.0.3"}}]},"published":"2026-04-30T22:16:25.477","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://exim.org/static/doc/security/CVE-2026-40684.txt"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/05/01/11"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"}],"source":"cve@mitre.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Exim","vendor":"Exim","versions":[{"lessThan":"4.99.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","matchCriteriaId":"E48EAA99-95DA-4695-BBEA-16D09AA0A508","versionEndExcluding":"4.99.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing."},{"lang":"es","value":"En Exim anterior a 4.99.2, en sistemas que usan musl libc (no glibc), un atacante puede provocar la caída de la instancia de conexión cuando hay datos DNS malformados presentes en los registros PTR. Esto es causado por una peculiaridad de dn_expand en la impresión octal."}],"id":"CVE-2026-40684","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:25:46.779854Z","version":"2.0.3"}}]},"published":"2026-04-30T22:16:25.477","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://code.exim.org/exim/exim/commit/628bbaca7672748d941a12e7cd5f0122a4e18c81"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://exim.org/static/doc/security/CVE-2026-40684.txt"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40684.assessment"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/05/01/11"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"}],"source":"cve@mitre.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-40685.json b/data/2026/CVE-2026-40685.json
index 24d24de1a1..c3cd40abd2 100644
--- a/data/2026/CVE-2026-40685.json
+++ b/data/2026/CVE-2026-40685.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Exim","vendor":"Exim","versions":[{"lessThan":"4.99.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","matchCriteriaId":"E48EAA99-95DA-4695-BBEA-16D09AA0A508","versionEndExcluding":"4.99.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping."}],"id":"CVE-2026-40685","lastModified":"2026-06-17T10:45:34.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40685","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:26:30.902958Z","version":"2.0.3"}}]},"published":"2026-04-30T22:16:25.633","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://code.exim.org/exim/exim/commit/9fdc057e71b87c87a0d3d2288b2810a0efaaba57"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://exim.org/static/doc/security/CVE-2026-40685.txt"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40685.assessment"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"}],"source":"cve@mitre.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Exim","vendor":"Exim","versions":[{"lessThan":"4.99.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","matchCriteriaId":"E48EAA99-95DA-4695-BBEA-16D09AA0A508","versionEndExcluding":"4.99.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \\ skipping."},{"lang":"es","value":"En Exim anterior a 4.99.2, cuando la búsqueda JSON está habilitada, puede ocurrir una escritura fuera de límites en el heap cuando un operador JSON encuentra JSON malformado en una cabecera no confiable, debido a una implementación incorrecta del salto de barra invertida."}],"id":"CVE-2026-40685","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40685","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:26:30.902958Z","version":"2.0.3"}}]},"published":"2026-04-30T22:16:25.633","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://code.exim.org/exim/exim/commit/9fdc057e71b87c87a0d3d2288b2810a0efaaba57"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://exim.org/static/doc/security/CVE-2026-40685.txt"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40685.assessment"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-684"}],"source":"cve@mitre.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-40686.json b/data/2026/CVE-2026-40686.json
index 1b3d19b056..fd4f4a62df 100644
--- a/data/2026/CVE-2026-40686.json
+++ b/data/2026/CVE-2026-40686.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Exim","vendor":"Exim","versions":[{"lessThan":"4.99.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","matchCriteriaId":"E48EAA99-95DA-4695-BBEA-16D09AA0A508","versionEndExcluding":"4.99.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message."}],"id":"CVE-2026-40686","lastModified":"2026-06-17T10:45:34.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40686","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:27:01.351716Z","version":"2.0.3"}}]},"published":"2026-04-30T22:16:25.787","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://code.exim.org/exim/exim/commit/f2570bde16fb4d4a1242ff363a4c4eecf6372efc"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://exim.org/static/doc/security/CVE-2026-40686.txt"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40686.assessment"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"cve@mitre.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Exim","vendor":"Exim","versions":[{"lessThan":"4.99.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","matchCriteriaId":"E48EAA99-95DA-4695-BBEA-16D09AA0A508","versionEndExcluding":"4.99.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message."},{"lang":"es","value":"En Exim antes de 4.99.2, cuando los operadores UTF-8 están habilitados, hay una lectura fuera de límites si hay caracteres de cola UTF-8 grandes presentes (datos de cabecera UTF-8 malformados). La información podría ser divulgada dentro de un mensaje de error producido durante el manejo de un mensaje de correo electrónico no relacionado."}],"id":"CVE-2026-40686","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40686","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:27:01.351716Z","version":"2.0.3"}}]},"published":"2026-04-30T22:16:25.787","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://code.exim.org/exim/exim/commit/f2570bde16fb4d4a1242ff363a4c4eecf6372efc"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://exim.org/static/doc/security/CVE-2026-40686.txt"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40686.assessment"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"cve@mitre.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-40687.json b/data/2026/CVE-2026-40687.json
index 20a73088cd..c9e88b192b 100644
--- a/data/2026/CVE-2026-40687.json
+++ b/data/2026/CVE-2026-40687.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Exim","vendor":"Exim","versions":[{"lessThan":"4.99.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","matchCriteriaId":"E48EAA99-95DA-4695-BBEA-16D09AA0A508","versionEndExcluding":"4.99.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory."}],"id":"CVE-2026-40687","lastModified":"2026-06-17T10:45:34.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40687","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:25:03.813157Z","version":"2.0.3"}}]},"published":"2026-04-30T22:16:25.923","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://exim.org/static/doc/security/CVE-2026-40687.txt"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-909"}],"source":"cve@mitre.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Exim","vendor":"Exim","versions":[{"lessThan":"4.99.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*","matchCriteriaId":"E48EAA99-95DA-4695-BBEA-16D09AA0A508","versionEndExcluding":"4.99.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory."},{"lang":"es","value":"En Exim antes de 4.99.2, cuando se utiliza el controlador de autenticación SPA con un recurso SPA adversario, puede haber una escritura fuera de límites que bloquea la instancia de conexión, o un procesamiento de datos erróneo que divulga datos de memoria de montón no inicializada."}],"id":"CVE-2026-40687","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40687","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:25:03.813157Z","version":"2.0.3"}}]},"published":"2026-04-30T22:16:25.923","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://code.exim.org/exim/exim/commit/68b963b9f75ca27b38e1c0f8c87037990199f505"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://exim.org/static/doc/security/CVE-2026-40687.txt"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://exim.org/static/doc/security/cve-2026-04.1/CVE2026-40687.assessment"},{"source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"],"url":"https://www.openwall.com/lists/oss-security/2026/04/30/21"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-909"}],"source":"cve@mitre.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-40912.json b/data/2026/CVE-2026-40912.json
index d5475d1628..c3e235625c 100644
--- a/data/2026/CVE-2026-40912.json
+++ b/data/2026/CVE-2026-40912.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.0.0-beta1, < 3.6.14"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779786779","versionType":"rpm"}]}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does not match the protected path patterns and therefore allows the request through. The backend then normalizes the dot-segment to the real path per RFC 3986 and serves the protected content An unauthenticated attacker can exploit this against any backend that performs dot-segment normalization. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."}],"id":"CVE-2026-40912","lastModified":"2026-07-15T02:21:10.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40912","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:53:15.470528Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:32.740","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-6jwx-7vp4-9847"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-40912"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464229"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40912.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.0.0-beta1, < 3.6.14"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.28::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.28","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779786779","versionType":"rpm"}]}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after stripping becomes a dot-segment (e.g. /./admin/secret). ForwardAuth receives this dot-segment path in X-Forwarded-Uri, which does not match the protected path patterns and therefore allows the request through. The backend then normalizes the dot-segment to the real path per RFC 3986 and serves the protected content An unauthenticated attacker can exploit this against any backend that performs dot-segment normalization. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."},{"lang":"es","value":"Traefik es un proxy inverso HTTP y balanceador de carga. Antes de las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2, existe una vulnerabilidad de omisión de autenticación de alta severidad en el middleware StripPrefixRegex de Traefik cuando se usa en combinación con ForwardAuth, BasicAuth o DigestAuth. El middleware compara la expresión regular con la ruta URL decodificada, pero usa la longitud de bytes resultante para cortar la ruta raw codificada en porcentaje. Cuando un punto (o múltiples puntos) aparece en la porción de prefijo de la URL, la ruta raw después de ser eliminada se convierte en un segmento de punto (p. ej. /./admin/secret). ForwardAuth recibe esta ruta de segmento de punto en X-Forwarded-Uri, que no coincide con los patrones de ruta protegidos y por lo tanto permite que la solicitud pase. El backend luego normaliza el segmento de punto a la ruta real según RFC 3986 y sirve el contenido protegido. Un atacante no autenticado puede explotar esto contra cualquier backend que realice la normalización de segmentos de punto. Este problema ha sido parcheado en las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2."}],"id":"CVE-2026-40912","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40912","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:53:15.470528Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:32.740","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-6jwx-7vp4-9847"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-40912"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464229"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40912.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41174.json b/data/2026/CVE-2026-41174.json
index aaa4168409..201cd1990a 100644
--- a/data/2026/CVE-2026-41174.json
+++ b/data/2026/CVE-2026-41174.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."}],"id":"CVE-2026-41174","lastModified":"2026-06-17T10:46:16.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-04T13:25:25.541487Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:33.240","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/traefik/traefik/commit/df00d82fc7f12e07199551832b54de6d0e55414d"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-xhjw-95fp-8vgq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-653"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a potential vulnerability in Traefik's Kubernetes CRD provider cross-namespace isolation enforcement. When providers.kubernetesCRD.allowCrossNamespace=false, Traefik correctly rejects direct cross-namespace middleware references from IngressRoute objects, but fails to apply the same restriction to middleware references nested inside a Chain middleware's spec.chain.middlewares[]. An actor with permission to create or update Traefik CRDs in their own namespace can exploit this to cause Traefik to resolve and apply middleware objects from another namespace, bypassing the documented isolation boundary. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."},{"lang":"es","value":"Traefik es un proxy inverso HTTP y un equilibrador de carga. Antes de las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2, existe una potencial vulnerabilidad en la aplicación del aislamiento entre espacios de nombres del proveedor CRD de Kubernetes de Traefik. Cuando providers.kubernetesCRD.allowCrossNamespace=false, Traefik rechaza correctamente las referencias directas de middleware entre espacios de nombres de los objetos IngressRoute, pero no aplica la misma restricción a las referencias de middleware anidadas dentro de spec.chain.middlewares[] de un middleware Chain. Un actor con permiso para crear o actualizar CRD de Traefik en su propio espacio de nombres puede exploit esto para hacer que Traefik resuelva y aplique objetos middleware de otro espacio de nombres, eludiendo el límite de aislamiento documentado. Este problema ha sido parcheado en las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2."}],"id":"CVE-2026-41174","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-04T13:25:25.541487Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:33.240","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/traefik/traefik/commit/df00d82fc7f12e07199551832b54de6d0e55414d"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-xhjw-95fp-8vgq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-653"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41263.json b/data/2026/CVE-2026-41263.json
index ba760771ab..dc2e8041ed 100644
--- a/data/2026/CVE-2026-41263.json
+++ b/data/2026/CVE-2026-41263.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.0.0-beta1, < 3.6.14"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."}],"id":"CVE-2026-41263","lastModified":"2026-06-17T10:46:24.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41263","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:22:30.689474Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:33.390","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-6x2q-h3cr-8j2h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-208"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"traefik","vendor":"traefik","versions":[{"status":"affected","version":"< 2.11.43"},{"status":"affected","version":">= 3.0.0-beta1, < 3.6.14"},{"status":"affected","version":">= 3.7.0-ea.1, < 3.7.0-rc.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"71119432-1348-4F69-A0E3-FA74592FA7EE","versionEndExcluding":"2.11.43","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","matchCriteriaId":"AA7AAE16-BBAD-434D-89F5-D52359D11D36","versionEndExcluding":"3.6.14","versionStartIncluding":"3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea1:*:*:*:*:*:*","matchCriteriaId":"7881B288-5141-4508-AB71-3F7586168437","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea2:*:*:*:*:*:*","matchCriteriaId":"AE5788A2-CCF9-4E87-8B94-133874F99CAE","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:ea3:*:*:*:*:*:*","matchCriteriaId":"B133B8F6-1C34-4354-9C1C-A5E063D27BC6","vulnerable":true},{"criteria":"cpe:2.3:a:traefik:traefik:3.7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"976D40ED-187E-4C95-BB5A-126F06B8FAD9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2."},{"lang":"es","value":"Traefik es un proxy inverso HTTP y balanceador de carga. Antes de las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2, existe una vulnerabilidad de canal lateral de temporización en el middleware BasicAuth de Traefik que permite a un atacante enumerar nombres de usuario válidos a través de diferencias en el tiempo de respuesta. La variable destinada a contener un secreto de respaldo de tiempo constante siempre se resuelve en una cadena vacía, lo que provoca que la comparación de tiempo constante se interrumpa en microsegundos en lugar de realizar una evaluación completa de bcrypt. Esto restaura el oráculo de temporización original y hace posible distinguir a los usuarios existentes de los no existentes midiendo los tiempos de respuesta de autenticación. Este problema ha sido parcheado en las versiones 2.11.43, 3.6.14 y 3.7.0-rc.2."}],"id":"CVE-2026-41263","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41263","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:22:30.689474Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:33.390","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/traefik/traefik/security/advisories/GHSA-6x2q-h3cr-8j2h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-208"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41375.json b/data/2026/CVE-2026-41375.json
index 19ed69adaf..5cb522a8cc 100644
--- a/data/2026/CVE-2026-41375.json
+++ b/data/2026/CVE-2026-41375.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks for external channels. Attackers can bypass authentication restrictions to arm or disarm phone channels without proper administrative privileges."}],"id":"CVE-2026-41375","lastModified":"2026-06-17T10:46:36.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41375","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:26:54.687842Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:40.280","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/aa66ae1fc797d3298cc409ed2c5da69a89950a45"},{"source":"disclosure@vulncheck.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h2v7-xc88-xx8c"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-phone-arm-and-phone-disarm-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin scope checks for external channels. Attackers can bypass authentication restrictions to arm or disarm phone channels without proper administrative privileges."},{"lang":"es","value":"OpenClaw anterior a 2026.3.28 contiene una vulnerabilidad de omisión de autorización en los endpoints /phone arm y /phone disarm que no aplica correctamente las comprobaciones de alcance operator.admin para canales externos. Los atacantes pueden omitir las restricciones de autenticación para armar o desarmar canales telefónicos sin los privilegios administrativos adecuados."}],"id":"CVE-2026-41375","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41375","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:26:54.687842Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:40.280","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/aa66ae1fc797d3298cc409ed2c5da69a89950a45"},{"source":"disclosure@vulncheck.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h2v7-xc88-xx8c"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-phone-arm-and-phone-disarm-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41378.json b/data/2026/CVE-2026-41378.json
index a759c51b2e..ff77a5f246 100644
--- a/data/2026/CVE-2026-41378.json
+++ b/data/2026/CVE-2026-41378.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote code execution on the gateway."}],"id":"CVE-2026-41378","lastModified":"2026-06-17T10:46:37.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:53:49.914550Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:40.687","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a77928b1087e90f2a8903f8e5aca6dec9237ac62"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gjm7-hw8f-73rq"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-to-remote-code-execution-via-unrestricted-node-event-agent-dispatch"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escalate privileges by leveraging unrestricted agent.request dispatch to achieve remote code execution on the gateway."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de escalada de privilegios que permite a los nodos emparejados con role=node despachar solicitudes de agente node.event con acceso ilimitado a herramientas del lado de la pasarela. Los atacantes con credenciales de nodo emparejado de confianza pueden escalar privilegios aprovechando el despacho ilimitado de agent.request para lograr la ejecución remota de código en la pasarela."}],"id":"CVE-2026-41378","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:53:49.914550Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:40.687","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a77928b1087e90f2a8903f8e5aca6dec9237ac62"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gjm7-hw8f-73rq"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-to-remote-code-execution-via-unrestricted-node-event-agent-dispatch"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41379.json b/data/2026/CVE-2026-41379.json
index 30f71f2a10..00c6cf8517 100644
--- a/data/2026/CVE-2026-41379.json
+++ b/data/2026/CVE-2026-41379.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persistence. Attackers with operator.write privileges can exploit the chat.send endpoint to reach and modify sensitive voice configuration settings intended for administrators only."}],"id":"CVE-2026-41379","lastModified":"2026-06-17T10:46:37.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:19:14.978263Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:40.820","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/e34694733fc64931ed4a543c73d84ad3435d5df1"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3q42-xmxv-9vfr"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-chat-send-to-admin-class-talk-voice-config"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice configuration persistence. Attackers with operator.write privileges can exploit the chat.send endpoint to reach and modify sensitive voice configuration settings intended for administrators only."},{"lang":"es","value":"OpenClaw anterior a 2026.3.28 contiene una vulnerabilidad de escalada de privilegios que permite a operadores autenticados con permisos de escritura acceder a la persistencia de configuración de Talk Voice de clase de administrador. Atacantes con privilegios operator.write pueden explotar el endpoint chat.send para alcanzar y modificar configuraciones de voz sensibles destinadas solo a administradores."}],"id":"CVE-2026-41379","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:19:14.978263Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:40.820","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/e34694733fc64931ed4a543c73d84ad3435d5df1"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3q42-xmxv-9vfr"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-chat-send-to-admin-class-talk-voice-config"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41380.json b/data/2026/CVE-2026-41380.json
index cd47c5d41d..3263cf6a50 100644
--- a/data/2026/CVE-2026-41380.json
+++ b/data/2026/CVE-2026-41380.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist entries than intended, weakening execution approval boundaries."}],"id":"CVE-2026-41380","lastModified":"2026-06-17T10:46:37.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41380","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:43:37.618355Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:40.957","references":[{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-execution-allowlist-via-wrapper-carrier-executables"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier executables instead of invoked targets. Attackers can exploit positional carrier executable routing through dispatch wrappers to establish broader allowlist entries than intended, weakening execution approval boundaries."},{"lang":"es","value":"OpenClaw anterior a 2026.3.28 contiene una vulnerabilidad de aprobación de ejecución en exec-approvals-allowlist.ts que permite la persistencia allow-always para confiar en ejecutables portadores wrapper en lugar de los objetivos invocados. Los atacantes pueden explotar el enrutamiento posicional de ejecutables portadores a través de wrappers de despacho para establecer entradas de allowlist más amplias de lo previsto, debilitando los límites de aprobación de ejecución."}],"id":"CVE-2026-41380","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41380","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:43:37.618355Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:40.957","references":[{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-execution-allowlist-via-wrapper-carrier-executables"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41381.json b/data/2026/CVE-2026-41381.json
index 7dfdab9cbc..31c0a2d796 100644
--- a/data/2026/CVE-2026-41381.json
+++ b/data/2026/CVE-2026-41381.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restrictions. Attackers can send Discord voice ingress requests before channel allowlist authorization is performed, gaining unauthorized access to restricted voice channels."}],"id":"CVE-2026-41381","lastModified":"2026-06-17T10:46:37.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41381","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:29:48.724269Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.097","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/dba96e7507e0900f120e5e28e57755d69bf78759"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cqgw-44wg-44rf"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-access-control-bypass-in-discord-voice-manager-via-channel-allowlist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allowlist restrictions. Attackers can send Discord voice ingress requests before channel allowlist authorization is performed, gaining unauthorized access to restricted voice channels."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de omisión de control de acceso en el gestor de voz de Discord que permite a los atacantes omitir las restricciones de la lista de permitidos de acceso de miembros a nivel de canal. Los atacantes pueden enviar solicitudes de entrada de voz de Discord antes de que se realice la autorización de la lista de permitidos del canal, obteniendo acceso no autorizado a canales de voz restringidos."}],"id":"CVE-2026-41381","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41381","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:29:48.724269Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.097","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/dba96e7507e0900f120e5e28e57755d69bf78759"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cqgw-44wg-44rf"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-access-control-bypass-in-discord-voice-manager-via-channel-allowlist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41382.json b/data/2026/CVE-2026-41382.json
index cc55df04d2..a45b16790b 100644
--- a/data/2026/CVE-2026-41382.json
+++ b/data/2026/CVE-2026-41382.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions. Attackers can exploit stale-role validation gaps and improper channel name validation to gain unauthorized access to restricted voice channels."}],"id":"CVE-2026-41382","lastModified":"2026-06-17T10:46:37.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41382","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:33:03.908007Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.230","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/dba96e7507e0900f120e5e28e57755d69bf78759"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x2m8-53h4-6hch"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-discord-voice-ingress-authorization-bypass-via-channel-and-role-validation-gaps"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions. Attackers can exploit stale-role validation gaps and improper channel name validation to gain unauthorized access to restricted voice channels."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de omisión de autorización en el ingreso de voz de Discord que permite a los atacantes omitir las restricciones de la lista de permitidos de canales y miembros. Los atacantes pueden explotar brechas de validación de roles obsoletos y validación incorrecta del nombre del canal para obtener acceso no autorizado a canales de voz restringidos."}],"id":"CVE-2026-41382","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41382","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:33:03.908007Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.230","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/dba96e7507e0900f120e5e28e57755d69bf78759"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x2m8-53h4-6hch"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-discord-voice-ingress-authorization-bypass-via-channel-and-role-validation-gaps"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41383.json b/data/2026/CVE-2026-41383.json
index b0f56c2bf9..c068ba3c01 100644
--- a/data/2026/CVE-2026-41383.json
+++ b/data/2026/CVE-2026-41383.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"9E93D9F1-C6FA-4AEE-AC8B-27CDEE77637C","versionEndExcluding":"2026.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can manipulate these OpenShell config paths to cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data."}],"id":"CVE-2026-41383","lastModified":"2026-06-17T10:46:37.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41383","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:49:59.958485Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.360","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/b21c9840c2e38f4bb338d031511b479d5f07ca25"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m34q-h93w-vg5x"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-remote-directory-deletion-via-mis-scoped-mirror-mode-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"9E93D9F1-C6FA-4AEE-AC8B-27CDEE77637C","versionEndExcluding":"2026.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can manipulate these OpenShell config paths to cause mirror sync operations to delete unintended remote directory contents and replace them with uploaded workspace data."},{"lang":"es","value":"OpenClaw anterior a 2026.4.2 contiene una vulnerabilidad de eliminación arbitraria de directorios en modo espejo que permite a los atacantes eliminar directorios remotos al influir en los valores de configuración remoteWorkspaceDir y remoteAgentWorkspaceDir. Los atacantes pueden manipular estas rutas de configuración de OpenShell para hacer que las operaciones de sincronización en espejo eliminen contenidos de directorios remotos no deseados y los reemplacen con datos de espacio de trabajo cargados."}],"id":"CVE-2026-41383","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41383","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:49:59.958485Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.360","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/b21c9840c2e38f4bb338d031511b479d5f07ca25"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m34q-h93w-vg5x"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-remote-directory-deletion-via-mis-scoped-mirror-mode-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41384.json b/data/2026/CVE-2026-41384.json
index 04d77a2347..fbc1c889a0 100644
--- a/data/2026/CVE-2026-41384.json
+++ b/data/2026/CVE-2026-41384.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.24","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.24","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"4220D4A6-550A-410D-9E21-4DAAB4E46485","versionEndExcluding":"2026.3.24","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables into the backend process spawning, enabling code execution or sensitive data exposure."}],"id":"CVE-2026-41384","lastModified":"2026-06-17T10:46:37.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41384","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:11:06.019131Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.497","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/c2fb7f1948c3226732a630256b5179a60664ec24"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vfw7-6rhc-6xxg"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-workspace-config-in-cli-backend"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-15"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.24","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.24","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"4220D4A6-550A-410D-9E21-4DAAB4E46485","versionEndExcluding":"2026.3.24","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables into the backend process spawning, enabling code execution or sensitive data exposure."},{"lang":"es","value":"OpenClaw anterior a 2026.3.24 contiene una vulnerabilidad de inyección de variables de entorno en el ejecutor del backend de la CLI que permite a los atacantes inyectar variables de entorno maliciosas a través de la configuración del espacio de trabajo. Los atacantes pueden crear configuraciones de espacio de trabajo maliciosas para inyectar variables de entorno arbitrarias en la generación de procesos de backend, lo que permite la ejecución de código o la exposición de datos sensibles."}],"id":"CVE-2026-41384","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41384","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:11:06.019131Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.497","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/c2fb7f1948c3226732a630256b5179a60664ec24"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vfw7-6rhc-6xxg"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-environment-variable-injection-via-workspace-config-in-cli-backend"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-15"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41385.json b/data/2026/CVE-2026-41385.json
index 76373eb326..1c7e00af38 100644
--- a/data/2026/CVE-2026-41385.json
+++ b/data/2026/CVE-2026-41385.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations."}],"id":"CVE-2026-41385","lastModified":"2026-06-17T10:46:37.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41385","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:18:42.576364Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.630","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/57700d716f660591fb6e09727f3ca8041fa48b9d"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jjw7-3vjf-fg5j"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-nostr-private-key-exposure-via-config-get-redaction-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms. Attackers can retrieve unredacted configuration data to obtain plaintext signing keys used for Nostr protocol operations."},{"lang":"es","value":"OpenClaw antes de 2026.3.31 almacena la clave privada de Nostr como texto sin cifrar en la configuración, permitiendo la exposición a través de llamadas al método config.get que eluden los mecanismos de redacción. Los atacantes pueden recuperar datos de configuración sin redactar para obtener claves de firma en texto sin cifrar utilizadas para operaciones del protocolo Nostr."}],"id":"CVE-2026-41385","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41385","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:18:42.576364Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.630","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/57700d716f660591fb6e09727f3ca8041fa48b9d"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jjw7-3vjf-fg5j"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-nostr-private-key-exposure-via-config-get-redaction-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41386.json b/data/2026/CVE-2026-41386.json
index 83f6158eb5..790b088e24 100644
--- a/data/2026/CVE-2026-41386.json
+++ b/data/2026/CVE-2026-41386.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope."}],"id":"CVE-2026-41386","lastModified":"2026-06-17T10:46:38.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41386","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:48:41.582369Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.770","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-648"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope."},{"lang":"es","value":"OpenClaw anterior a 2026.3.22 contiene una vulnerabilidad de escalada de privilegios donde los códigos de configuración de arranque no están vinculados a los roles y alcances de dispositivo previstos durante el emparejamiento. Los atacantes pueden explotar esto durante el emparejamiento de dispositivos de primer uso para escalar privilegios más allá de su rol y alcance previstos."}],"id":"CVE-2026-41386","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41386","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:48:41.582369Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.770","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a600c72ed7d0045a27f58bf031d2b36ecb0141c9"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-unbound-bootstrap-setup-codes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-648"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41387.json b/data/2026/CVE-2026-41387.json
index 2f0fee9b7f..8a1929f126 100644
--- a/data/2026/CVE-2026-41387.json
+++ b/data/2026/CVE-2026-41387.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content."}],"id":"CVE-2026-41387","lastModified":"2026-06-17T10:46:38.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:50:39.434785Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.910","references":[{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-supply-chain-redirection-via-incomplete-host-environment-sanitization"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-183"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec requests to redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content."},{"lang":"es","value":"OpenClaw anterior a 2026.3.22 contiene una vulnerabilidad de saneamiento incompleto de variables de entorno de host en host-env-security-policy.json y host-env-security.ts que permite anulaciones de entorno del gestor de paquetes. Los atacantes pueden explotar solicitudes de ejecución (exec) aprobadas para redirigir la resolución de paquetes o el arranque (bootstrap) en tiempo de ejecución a infraestructura controlada por el atacante y ejecutar contenido troyanizado."}],"id":"CVE-2026-41387","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:50:39.434785Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:41.910","references":[{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-supply-chain-redirection-via-incomplete-host-environment-sanitization"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-183"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41388.json b/data/2026/CVE-2026-41388.json
index fc51fb62d3..0fe29c0c96 100644
--- a/data/2026/CVE-2026-41388.json
+++ b/data/2026/CVE-2026-41388.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file state, bypassing intended revocation controls."}],"id":"CVE-2026-41388","lastModified":"2026-06-17T10:46:38.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41388","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:28:29.274530Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.040","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a4d72a83f01fedd35964c352e3473c7712a3511b"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3pm9-5j7m-59vc"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-configuration-rehydration-via-empty-array-revocation-handling"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-372"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers can restart the application to rehydrate revoked Tlon configuration from file state, bypassing intended revocation controls."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de gestión de configuración donde la migración de inicio trata las configuraciones de matriz vacía como valores faltantes. Los atacantes pueden reiniciar la aplicación para rehidratar la configuración de Tlon revocada desde el estado del archivo, eludiendo los controles de revocación previstos."}],"id":"CVE-2026-41388","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41388","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:28:29.274530Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.040","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a4d72a83f01fedd35964c352e3473c7712a3511b"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3pm9-5j7m-59vc"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-configuration-rehydration-via-empty-array-revocation-handling"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-372"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41390.json b/data/2026/CVE-2026-41390.json
index e31ae36e98..4cd618111e 100644
--- a/data/2026/CVE-2026-41390.json
+++ b/data/2026/CVE-2026-41390.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs."}],"id":"CVE-2026-41390","lastModified":"2026-06-17T10:46:38.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41390","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:25:11.901340Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.173","references":[{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistered-usr-bin-script-wrapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers before storing trust decisions. Attackers can obtain user approval for one wrapped command to persist trust for wrapper binaries that execute different underlying programs."},{"lang":"es","value":"OpenClaw anterior a 2026.3.28 contiene una vulnerabilidad de omisión de lista de permitidos de ejecución donde la persistencia de permitir siempre no logra desencapsular /usr/bin/script y envoltorios similares antes de almacenar las decisiones de confianza. Los atacantes pueden obtener la aprobación del usuario para que un comando encapsulado persista la confianza para binarios envoltorio que ejecutan programas subyacentes diferentes."}],"id":"CVE-2026-41390","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41390","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:25:11.901340Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.173","references":[{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-unregistered-usr-bin-script-wrapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41391.json b/data/2026/CVE-2026-41391.json
index 6fbb1fe805..734e6610a9 100644
--- a/data/2026/CVE-2026-41391.json
+++ b/data/2026/CVE-2026-41391.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting malicious index URLs through unsanitized environment variables."}],"id":"CVE-2026-41391","lastModified":"2026-06-17T10:46:38.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41391","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:25:34.913361Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.310","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/7ae1bb0c7799fd0cbd2d4de7b0f5b8039837ab8d"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7ggg-pvrf-458v"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-environment-variable-bypass-in-package-index-url-handling"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting malicious index URLs through unsanitized environment variables."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 no logra sanear adecuadamente las variables de entorno PIP_INDEX_URL y UV_INDEX_URL en contextos de ejecución del host, permitiendo a los atacantes redirigir el tráfico del índice de paquetes de Python. Los atacantes pueden explotar este bypass para interceptar o manipular operaciones de gestión de paquetes inyectando URLs de índice maliciosas a través de variables de entorno no saneadas."}],"id":"CVE-2026-41391","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41391","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:25:34.913361Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.310","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/7ae1bb0c7799fd0cbd2d4de7b0f5b8039837ab8d"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7ggg-pvrf-458v"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-environment-variable-bypass-in-package-index-url-handling"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41392.json b/data/2026/CVE-2026-41392.json
index dda5a28034..a5efee0737 100644
--- a/data/2026/CVE-2026-41392.json
+++ b/data/2026/CVE-2026-41392.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations. Attackers can exploit shell options like --rcfile, --init-file, and --startup-file to load attacker-chosen initialization files while bypassing exec allowlist matching restrictions."}],"id":"CVE-2026-41392","lastModified":"2026-06-17T10:46:38.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41392","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:18:08.724489Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.447","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/0c8375424620e12777ef24c162eedc7e9fcfd7e3"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wpc6-37g7-8q4w"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-shell-init-file-options"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations. Attackers can exploit shell options like --rcfile, --init-file, and --startup-file to load attacker-chosen initialization files while bypassing exec allowlist matching restrictions."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de omisión de lista de permitidos de ejecución que permite a los atacantes heredar la confianza de la lista de permitidos a través de invocaciones de envoltorios de archivos de inicialización de shell. Los atacantes pueden explotar opciones de shell como --rcfile, --init-file y --startup-file para cargar archivos de inicialización elegidos por el atacante mientras omiten las restricciones de coincidencia de la lista de permitidos de ejecución."}],"id":"CVE-2026-41392","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41392","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:18:08.724489Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.447","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/0c8375424620e12777ef24c162eedc7e9fcfd7e3"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wpc6-37g7-8q4w"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-exec-allowlist-bypass-via-shell-init-file-options"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41393.json b/data/2026/CVE-2026-41393.json
index 31dff044b3..05c4eaf97a 100644
--- a/data/2026/CVE-2026-41393.json
+++ b/data/2026/CVE-2026-41393.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator credentials through DNS steering manipulation."}],"id":"CVE-2026-41393","lastModified":"2026-06-17T10:46:38.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41393","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:50:17.528000Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.590","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a23c33a681f8c1b22dc793995acc4c5c4b568346"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q9w8-cf67-r238"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-dns-authority-acceptance-and-credential-exfiltration-via-wide-area-discovery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-tailnet position and CA-trusted endpoint access can exfiltrate operator credentials through DNS steering manipulation."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de descubrimiento de área amplia que permite que pares de tailnet arbitrarios sean aceptados como autoridades DNS. Atacantes con posición en el mismo tailnet y acceso a un endpoint de confianza de CA pueden exfiltrar credenciales del operador mediante manipulación del direccionamiento DNS."}],"id":"CVE-2026-41393","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41393","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:50:17.528000Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.590","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a23c33a681f8c1b22dc793995acc4c5c4b568346"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q9w8-cf67-r238"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-arbitrary-dns-authority-acceptance-and-credential-exfiltration-via-wide-area-discovery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41394.json b/data/2026/CVE-2026-41394.json
index 684b392050..b0e0d7a27d 100644
--- a/data/2026/CVE-2026-41394.json
+++ b/data/2026/CVE-2026-41394.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators."}],"id":"CVE-2026-41394","lastModified":"2026-06-17T10:46:39.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41394","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:51:37.048297Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.737","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/2a1db0c0f1fa375004a95ba0ef030534790a6d47"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mhgq-xpfq-6r66"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unauthorized-operator-scope-access-in-unauthenticated-plugin-auth-routes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime actions intended for authorized operators."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de omisión de autenticación donde las rutas HTTP plugin-auth no autenticadas reciben ámbitos de escritura en tiempo de ejecución del operador. Los atacantes pueden acceder a estas rutas sin autenticación para realizar acciones privilegiadas en tiempo de ejecución destinadas a operadores autorizados."}],"id":"CVE-2026-41394","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41394","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:51:37.048297Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.737","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/2a1db0c0f1fa375004a95ba0ef030534790a6d47"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mhgq-xpfq-6r66"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unauthorized-operator-scope-access-in-unauthenticated-plugin-auth-routes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41395.json b/data/2026/CVE-2026-41395.json
index 6157ca8a66..1f6a90e5cb 100644
--- a/data/2026/CVE-2026-41395.json
+++ b/data/2026/CVE-2026-41395.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay cache detection and trigger duplicate voice-call processing with a captured valid signed webhook."}],"id":"CVE-2026-41395","lastModified":"2026-06-17T10:46:39.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41395","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:20:49.244265Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.880","references":[{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8689-gm9g-jgr6"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-webhook-replay-via-query-parameter-reordering-in-plivo-v3"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-325"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay cache detection and trigger duplicate voice-call processing with a captured valid signed webhook."},{"lang":"es","value":"OpenClaw anterior a 2026.3.28 contiene una vulnerabilidad de repetición de webhook en la verificación de firma de Plivo V3 que canoniza el orden de las consultas para las firmas pero aplica hash a las URL sin procesar para la detección de repetición. Los atacantes pueden reordenar los parámetros de consulta para eludir la detección de caché de repetición y activar el procesamiento duplicado de llamadas de voz con un webhook firmado válido capturado."}],"id":"CVE-2026-41395","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41395","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:20:49.244265Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:42.880","references":[{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8689-gm9g-jgr6"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-webhook-replay-via-query-parameter-reordering-in-plivo-v3"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-325"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41396.json b/data/2026/CVE-2026-41396.json
index 40584b144c..58a1a3448d 100644
--- a/data/2026/CVE-2026-41396.json
+++ b/data/2026/CVE-2026-41396.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory."}],"id":"CVE-2026-41396","lastModified":"2026-06-17T10:46:39.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:16:36.354885Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.013","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-environment-variable-override-of-plugin-trust-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by overriding the bundled plugin trust root directory."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 permite que los archivos .env del espacio de trabajo anulen la variable de entorno OPENCLAW_BUNDLED_PLUGINS_DIR, comprometiendo la verificación de confianza de los plugins. Los atacantes con control sobre la configuración del espacio de trabajo pueden inyectar plugins maliciosos al anular el directorio raíz de confianza de los plugins incluidos."}],"id":"CVE-2026-41396","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41396","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:16:36.354885Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.013","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/330a9f98cb29c79b1c16a2117e03d6276a0d6289"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-environment-variable-override-of-plugin-trust-root"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41397.json b/data/2026/CVE-2026-41397.json
index 942c96c186..6f4c807ca0 100644
--- a/data/2026/CVE-2026-41397.json
+++ b/data/2026/CVE-2026-41397.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchronization operations. Remote attackers can bypass sandbox restrictions by crafting malicious symlinks in mirror sync operations to access arbitrary files outside intended boundaries."}],"id":"CVE-2026-41397","lastModified":"2026-06-17T10:46:39.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41397","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:37:54.692011Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.153","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/3b9dab0ece4643a9643e6a45459f5c709d3ce320"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cwf8-44x6-32c2"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-sandbox-escape-via-unrestricted-file-sync-and-symlink-traversal"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchronization operations. Remote attackers can bypass sandbox restrictions by crafting malicious symlinks in mirror sync operations to access arbitrary files outside intended boundaries."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de escape de sandbox que permite a los atacantes atravesar los límites del directorio mediante la explotación de symlinks durante las operaciones de sincronización de archivos. Los atacantes remotos pueden eludir las restricciones de la sandbox creando symlinks maliciosos en operaciones de sincronización espejo para acceder a archivos arbitrarios fuera de los límites previstos."}],"id":"CVE-2026-41397","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41397","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:37:54.692011Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.153","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/3b9dab0ece4643a9643e6a45459f5c709d3ce320"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/c02ee8a3a4cb390b23afdf21317aa8b2096854d1"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cwf8-44x6-32c2"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-sandbox-escape-via-unrestricted-file-sync-and-symlink-traversal"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41398.json b/data/2026/CVE-2026-41398.json
index e6197d2a57..2d181e8870 100644
--- a/data/2026/CVE-2026-41398.json
+++ b/data/2026/CVE-2026-41398.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"9E93D9F1-C6FA-4AEE-AC8B-27CDEE77637C","versionEndExcluding":"2026.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. Attackers can inject unauthorized agent.request runs by loading attacker-controlled pages from local-network or tailnet hosts, polluting session state and consuming budget."}],"id":"CVE-2026-41398","lastModified":"2026-06-17T10:46:39.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.1,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41398","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:17:31.800166Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.287","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/49d08382a90f71dabe2877b3f6729ad85f808d57"},{"source":"disclosure@vulncheck.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4p4f-fc8q-84m3"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unauthorized-agent-request-dispatch-via-untrusted-local-network-pages-in-ios-a2ui-bridge"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"9E93D9F1-C6FA-4AEE-AC8B-27CDEE77637C","versionEndExcluding":"2026.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. Attackers can inject unauthorized agent.request runs by loading attacker-controlled pages from local-network or tailnet hosts, polluting session state and consuming budget."},{"lang":"es","value":"OpenClaw anterior a 2026.4.2 contiene una vulnerabilidad de control de acceso inadecuado en el puente A2UI de iOS que trata las páginas genéricas de la red local como orígenes de confianza. Los atacantes pueden inyectar ejecuciones no autorizadas de agent.request cargando páginas controladas por el atacante desde hosts de red local o tailnet, contaminando el estado de la sesión y consumiendo presupuesto."}],"id":"CVE-2026-41398","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.1,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41398","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:17:31.800166Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.287","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/49d08382a90f71dabe2877b3f6729ad85f808d57"},{"source":"disclosure@vulncheck.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4p4f-fc8q-84m3"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unauthorized-agent-request-dispatch-via-untrusted-local-network-pages-in-ios-a2ui-bridge"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41399.json b/data/2026/CVE-2026-41399.json
index f029f92605..e4976324a8 100644
--- a/data/2026/CVE-2026-41399.json
+++ b/data/2026/CVE-2026-41399.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket availability for legitimate clients."}],"id":"CVE-2026-41399","lastModified":"2026-06-17T10:46:39.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:51:06.683948Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.420","references":[{"source":"disclosure@vulncheck.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f44p-c7w9-7xr7"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unbounded-pre-auth-websocket-upgrades"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.28","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.28","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"16831C6C-CC20-4318-8F7C-9FCFB12A223F","versionEndExcluding":"2026.3.28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket availability for legitimate clients."},{"lang":"es","value":"OpenClaw antes de 2026.3.28 acepta actualizaciones concurrentes ilimitadas de WebSocket no autenticadas sin asignación de presupuesto de preautenticación. Atacantes de red no autenticados pueden agotar la capacidad de sockets y trabajadores para interrumpir la disponibilidad de WebSocket para clientes legítimos."}],"id":"CVE-2026-41399","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:51:06.683948Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.420","references":[{"source":"disclosure@vulncheck.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f44p-c7w9-7xr7"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unbounded-pre-auth-websocket-upgrades"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41400.json b/data/2026/CVE-2026-41400.json
index ff4e5603ce..78ff7016b9 100644
--- a/data/2026/CVE-2026-41400.json
+++ b/data/2026/CVE-2026-41400.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. Remote attackers can send oversized pre-start WebSocket frames to cause resource consumption and denial of service."}],"id":"CVE-2026-41400","lastModified":"2026-06-17T10:46:39.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41400","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:52:26.350243Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.553","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/9abcfdadf591bf266d85fbdfe14ae833e557a110"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2w79-r9g8-wmcr"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-resource-consumption-via-oversized-websocket-frames-in-voice-call"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. Remote attackers can send oversized pre-start WebSocket frames to cause resource consumption and denial of service."},{"lang":"es","value":"OpenClaw antes de 2026.3.31 contiene una solución incompleta para CVE-2026-32062, donde el componente de llamadas de voz analiza tramas WebSocket grandes antes de la validación de inicio. Los atacantes remotos pueden enviar tramas WebSocket pre-inicio de tamaño excesivo para causar consumo de recursos y denegación de servicio."}],"id":"CVE-2026-41400","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41400","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:52:26.350243Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.553","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/9abcfdadf591bf266d85fbdfe14ae833e557a110"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2w79-r9g8-wmcr"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-resource-consumption-via-oversized-websocket-frames-in-voice-call"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41402.json b/data/2026/CVE-2026-41402.json
index de0f7d71d0..7df318af39 100644
--- a/data/2026/CVE-2026-41402.json
+++ b/data/2026/CVE-2026-41402.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly broad cache keying to bypass replay protection and deliver duplicate webhook messages to unintended targets."}],"id":"CVE-2026-41402","lastModified":"2026-06-17T10:46:40.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:17:15.638964Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.690","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/4d038bb242c11f39e45f6a4bde400e5fd42e4ebf"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hhq4-97c2-p447"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-webhook-replay-cache-cross-target-messageid-scope-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages across sibling targets using the same messageId. Attackers can exploit overly broad cache keying to bypass replay protection and deliver duplicate webhook messages to unintended targets."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de omisión de alcance en la deduplicación de caché de repetición de webhook que permite a atacantes autenticados repetir mensajes entre objetivos hermanos utilizando el mismo messageId. Los atacantes pueden explotar el claveado de caché excesivamente amplio para omitir la protección contra repeticiones y entregar mensajes de webhook duplicados a objetivos no deseados."}],"id":"CVE-2026-41402","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:17:15.638964Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.690","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/4d038bb242c11f39e45f6a4bde400e5fd42e4ebf"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hhq4-97c2-p447"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-webhook-replay-cache-cross-target-messageid-scope-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41403.json b/data/2026/CVE-2026-41403.json
index 962cb88c4b..40ff45a7c1 100644
--- a/data/2026/CVE-2026-41403.json
+++ b/data/2026/CVE-2026-41403.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions."}],"id":"CVE-2026-41403","lastModified":"2026-06-17T10:46:40.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:09:33.617319Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.823","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a6828a002c"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-access-control-bypass-via-proxied-remote-request-misclassification"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access. Attackers can bypass access controls by sending proxied requests that are incorrectly identified as local loopback traffic, circumventing intended remote viewer restrictions."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 clasifica erróneamente las solicitudes remotas intermediadas como conexiones de bucle invertido en el visor de diferencias cuando allowRemoteViewer está deshabilitado, permitiendo el acceso no autorizado. Los atacantes pueden eludir los controles de acceso enviando solicitudes intermediadas que son identificadas incorrectamente como tráfico local de bucle invertido, sorteando las restricciones previstas para el visor remoto."}],"id":"CVE-2026-41403","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.4,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:09:33.617319Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.823","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/30a1690323088fd291abd11643a264a6828a002c"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-access-control-bypass-via-proxied-remote-request-misclassification"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41404.json b/data/2026/CVE-2026-41404.json
index db44309c4c..3056dc4865 100644
--- a/data/2026/CVE-2026-41404.json
+++ b/data/2026/CVE-2026-41404.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, allowing self-declared scopes to persist on identity-bearing authentication paths and escalate privileges."}],"id":"CVE-2026-41404","lastModified":"2026-06-17T10:46:40.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:38:09.302319Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.957","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/8b88b927cb0747ad24d95b07d35682bf85dc5b0e"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g374-mggx-p6xc"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-operator-admin-privilege-escalation-via-trusted-proxy-authentication"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, allowing self-declared scopes to persist on identity-bearing authentication paths and escalate privileges."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de borrado de alcance incompleto en modo de autenticación de proxy de confianza que permite la escalada de privilegios de operator.admin. Los atacantes pueden explotar esto declarando alcances de operador en clientes que no son de Control-UI, permitiendo que los alcances autodeclarados persistan en rutas de autenticación que portan identidad y escalen privilegios."}],"id":"CVE-2026-41404","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:38:09.302319Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:43.957","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/8b88b927cb0747ad24d95b07d35682bf85dc5b0e"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g374-mggx-p6xc"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-operator-admin-privilege-escalation-via-trusted-proxy-authentication"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41405.json b/data/2026/CVE-2026-41405.json
index 61faac790a..76d54dffeb 100644
--- a/data/2026/CVE-2026-41405.json
+++ b/data/2026/CVE-2026-41405.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypassing authentication checks."}],"id":"CVE-2026-41405","lastModified":"2026-06-17T10:46:40.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41405","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:16:45.573595Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.090","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/3834d47099dd13c8244ed6de8b9ea9855c553623"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p464-m8x6-vhv8"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-resource-exhaustion-via-unauthenticated-ms-teams-webhook-body-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-408"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server resources by bypassing authentication checks."},{"lang":"es","value":"OpenClaw antes de 2026.3.31 analiza los cuerpos de las solicitudes de webhook de MS Teams antes de realizar la validación JWT, permitiendo a atacantes no autenticados desencadenar el agotamiento de recursos. Atacantes remotos pueden enviar cargas útiles maliciosas de webhook de Teams para agotar los recursos del servidor eludiendo las comprobaciones de autenticación."}],"id":"CVE-2026-41405","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41405","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:16:45.573595Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.090","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/3834d47099dd13c8244ed6de8b9ea9855c553623"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p464-m8x6-vhv8"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-resource-exhaustion-via-unauthenticated-ms-teams-webhook-body-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-408"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41406.json b/data/2026/CVE-2026-41406.json
index 15226070ff..b8ff3c62bc 100644
--- a/data/2026/CVE-2026-41406.json
+++ b/data/2026/CVE-2026-41406.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, and thread context messages to bypass sender allowlist restrictions and retrieve unauthorized content."}],"id":"CVE-2026-41406","lastModified":"2026-06-17T10:46:40.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:52:10.530571Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.280","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/f45e5a6569aab1d58cc6de25b19f1dc4c8779b85"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-877v-w3f5-3pcq"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-thread-history-and-quoted-messages"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fetched quoted, root, and thread context messages to bypass sender allowlist restrictions and retrieve unauthorized content."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de omisión de lista blanca de remitentes que permite a atacantes remotos acceder a mensajes restringidos. Los atacantes pueden explotar mensajes citados, raíz y de contexto de hilo recuperados para omitir las restricciones de la lista blanca de remitentes y recuperar contenido no autorizado."}],"id":"CVE-2026-41406","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:52:10.530571Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.280","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/f45e5a6569aab1d58cc6de25b19f1dc4c8779b85"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-877v-w3f5-3pcq"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-thread-history-and-quoted-messages"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41407.json b/data/2026/CVE-2026-41407.json
index d45c8936c2..e621326868 100644
--- a/data/2026/CVE-2026-41407.json
+++ b/data/2026/CVE-2026-41407.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"9E93D9F1-C6FA-4AEE-AC8B-27CDEE77637C","versionEndExcluding":"2026.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of fixed-length comparison helpers. Attackers can measure timing differences to leak secret-length information, weakening constant-time handling for shared secrets."}],"id":"CVE-2026-41407","lastModified":"2026-06-17T10:46:40.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:53:09.049114Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.433","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/be10ecef770a4654519869c3641bbb91087c8c7b"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jj6q-rrrf-h66h"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-timing-side-channel-in-shared-secret-comparison"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-208"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"9E93D9F1-C6FA-4AEE-AC8B-27CDEE77637C","versionEndExcluding":"2026.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of fixed-length comparison helpers. Attackers can measure timing differences to leak secret-length information, weakening constant-time handling for shared secrets."},{"lang":"es","value":"OpenClaw anterior a 2026.4.2 contiene una vulnerabilidad de canal lateral de temporización en sitios de llamada de comparación de secretos compartidos que utilizan comprobaciones tempranas de desajuste de longitud en lugar de ayudantes de comparación de longitud fija. Los atacantes pueden medir diferencias de temporización para filtrar información sobre la longitud del secreto, debilitando el manejo de tiempo constante para los secretos compartidos."}],"id":"CVE-2026-41407","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:53:09.049114Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.433","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/be10ecef770a4654519869c3641bbb91087c8c7b"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jj6q-rrrf-h66h"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-timing-side-channel-in-shared-secret-comparison"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-208"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41408.json b/data/2026/CVE-2026-41408.json
index 1611d628f8..7cd86a390e 100644
--- a/data/2026/CVE-2026-41408.json
+++ b/data/2026/CVE-2026-41408.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations. Attackers can exhaust disk space by downloading media files without triggering intended safety restrictions, causing availability impact."}],"id":"CVE-2026-41408","lastModified":"2026-06-17T10:46:40.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:35:12.377562Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.567","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/2194587d70d2aef863508b945319c5a7c88b12ce"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4g5x-2jfc-xm98"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-disk-exhaustion-via-media-download-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.31","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.31","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"35B1FB5C-EA5A-4095-9226-F947A9B3B984","versionEndExcluding":"2026.3.31","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations. Attackers can exhaust disk space by downloading media files without triggering intended safety restrictions, causing availability impact."},{"lang":"es","value":"OpenClaw anterior a 2026.3.31 contiene una vulnerabilidad de agotamiento de recursos en las descargas de medios que elude los límites de seguridad fundamentales para el tamaño de archivo, el recuento y las operaciones de limpieza. Los atacantes pueden agotar el espacio en disco al descargar archivos multimedia sin activar las restricciones de seguridad previstas, causando un impacto en la disponibilidad."}],"id":"CVE-2026-41408","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41408","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:35:12.377562Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.567","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/2194587d70d2aef863508b945319c5a7c88b12ce"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4g5x-2jfc-xm98"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-disk-exhaustion-via-media-download-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41499.json b/data/2026/CVE-2026-41499.json
index 34bb02a6ad..cbbb6d94b9 100644
--- a/data/2026/CVE-2026-41499.json
+++ b/data/2026/CVE-2026-41499.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.0.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"8147D947-167A-4F70-A689-81B33A161A83","versionEndExcluding":"4.14.4","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4."}],"id":"CVE-2026-41499","lastModified":"2026-06-17T10:46:48.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41499","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:31:03.330693Z","version":"2.0.3"}}]},"published":"2026-04-29T19:16:23.780","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-qvqj-p8mm-r7h3"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-qvqj-p8mm-r7h3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"},{"lang":"en","value":"CWE-191"}],"source":"security-advisories@github.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"wazuh","vendor":"wazuh","versions":[{"status":"affected","version":">= 4.0.0, < 4.14.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*","matchCriteriaId":"8147D947-167A-4F70-A689-81B33A161A83","versionEndExcluding":"4.14.4","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, multiple heap-based out-of-bounds WRITE vulnerabilities exist in parse_uname_string() (remoted_op.c). This function processes OS identification data from agents and contains a dangerous code pattern that appears in 4 locations within the same function: writing to strlen(ptr) - 1 without checking for empty strings. When the string is empty, strlen() returns 0, and 0 - 1 wraps to SIZE_MAX due to unsigned integer underflow. Due to pointer arithmetic wrapping, SIZE_MAX effectively becomes -1, causing a write exactly 1 byte before the allocated buffer. This corrupts heap metadata (e.g., the chunk size field in glibc malloc), leading to heap corruption. This issue has been patched in version 4.14.4."},{"lang":"es","value":"Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta ante amenazas. Desde la versión 4.0.0 hasta antes de la versión 4.14.4, existen múltiples vulnerabilidades de ESCRITURA fuera de límites basadas en el heap en parse_uname_string() (remoted_op.c). Esta función procesa datos de identificación del sistema operativo de los agentes y contiene un patrón de código peligroso que aparece en 4 ubicaciones dentro de la misma función: escribiendo en strlen(ptr) - 1 sin verificar si hay cadenas vacías. Cuando la cadena está vacía, strlen() devuelve 0, y 0 - 1 se ajusta a SIZE_MAX debido a un desbordamiento negativo de entero sin signo. Debido al ajuste de la aritmética de punteros, SIZE_MAX se convierte efectivamente en -1, causando una escritura exactamente 1 byte antes del búfer asignado. Esto corrompe los metadatos del heap (por ejemplo, el campo de tamaño de chunk en glibc malloc), lo que lleva a la corrupción del heap. Este problema ha sido parcheado en la versión 4.14.4."}],"id":"CVE-2026-41499","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41499","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:31:03.330693Z","version":"2.0.3"}}]},"published":"2026-04-29T19:16:23.780","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.4"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-qvqj-p8mm-r7h3"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"],"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-qvqj-p8mm-r7h3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"},{"lang":"en","value":"CWE-191"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41910.json b/data/2026/CVE-2026-41910.json
index 2f6f65529a..40191afebd 100644
--- a/data/2026/CVE-2026-41910.json
+++ b/data/2026/CVE-2026-41910.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass access controls to perform allowlist modifications against different channels, violating the intended trust model."}],"id":"CVE-2026-41910","lastModified":"2026-06-17T10:47:10.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41910","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:04:48.427059Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.697","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vc32-h5mq-453v"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-missing-owner-only-enforcement-in-allowlist-cross-channel-writes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass access controls to perform allowlist modifications against different channels, violating the intended trust model."},{"lang":"es","value":"OpenClaw antes de 2026.4.8 omite la aplicación exclusiva del propietario para escrituras en la lista de permitidos entre canales en el endpoint /allowlist. Un remitente autorizado no propietario puede eludir los controles de acceso para realizar modificaciones en la lista de permitidos contra diferentes canales, violando el modelo de confianza previsto."}],"id":"CVE-2026-41910","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41910","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:04:48.427059Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.697","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vc32-h5mq-453v"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-missing-owner-only-enforcement-in-allowlist-cross-channel-writes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41911.json b/data/2026/CVE-2026-41911.json
index 03d0ed43d8..3874680621 100644
--- a/data/2026/CVE-2026-41911.json
+++ b/data/2026/CVE-2026-41911.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries. Attackers can exploit upload_file and upload_image endpoints to access files beyond the intended workspace-only filesystem policy."}],"id":"CVE-2026-41911","lastModified":"2026-06-17T10:47:10.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41911","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:39:00.198977Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.833","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5fc7-f62m-8983"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-workspace-only-filesystem-policy-bypass-via-docx-upload-file-upload-image"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries. Attackers can exploit upload_file and upload_image endpoints to access files beyond the intended workspace-only filesystem policy."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de omisión de política de sistema de archivos en el procesamiento de carga de archivos docx que permite lecturas de archivos locales fuera de los límites del espacio de trabajo. Los atacantes pueden explotar los puntos finales upload_file y upload_image para acceder a archivos más allá de la política de sistema de archivos prevista, limitada solo al espacio de trabajo."}],"id":"CVE-2026-41911","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41911","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:39:00.198977Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.833","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5fc7-f62m-8983"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-workspace-only-filesystem-policy-bypass-via-docx-upload-file-upload-image"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41912.json b/data/2026/CVE-2026-41912.json
index 49b6885744..b4e52ad0ac 100644
--- a/data/2026/CVE-2026-41912.json
+++ b/data/2026/CVE-2026-41912.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access restricted resources."}],"id":"CVE-2026-41912","lastModified":"2026-06-17T10:47:11.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41912","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:15:48.353810Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.970","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vr5g-mmx7-h897"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-policy-bypass-via-interaction-triggered-navigation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access restricted resources."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de omisión de política de falsificación de petición del lado del servidor que permite a los atacantes desencadenar navegaciones omitiendo las comprobaciones normales de SSRF. Los atacantes pueden explotar las interacciones del navegador para omitir las protecciones de SSRF y acceder a recursos restringidos."}],"id":"CVE-2026-41912","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41912","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:15:48.353810Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:44.970","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vr5g-mmx7-h897"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-policy-bypass-via-interaction-triggered-navigation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41913.json b/data/2026/CVE-2026-41913.json
index a006a8f7c4..43733bcac2 100644
--- a/data/2026/CVE-2026-41913.json
+++ b/data/2026/CVE-2026-41913.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"29FA0977-309A-40E9-87FE-FE1BB2466DB2","versionEndExcluding":"2026.4.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per-key rate-limit budget. Attackers can exploit this by sending multiple simultaneous authentication attempts to circumvent intended rate-limiting protections on Tailscale-capable paths."}],"id":"CVE-2026-41913","lastModified":"2026-06-17T10:47:11.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41913","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:46:26.346297Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.103","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-25wv-8phj-8p7r"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-rate-limit-bypass-via-concurrent-async-authentication-attempts"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"29FA0977-309A-40E9-87FE-FE1BB2466DB2","versionEndExcluding":"2026.4.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per-key rate-limit budget. Attackers can exploit this by sending multiple simultaneous authentication attempts to circumvent intended rate-limiting protections on Tailscale-capable paths."},{"lang":"es","value":"OpenClaw antes de 2026.4.4 contiene una vulnerabilidad de condición de carrera en la autenticación de secreto compartido que permite que solicitudes asíncronas concurrentes eludan el presupuesto de límite de tasa por clave. Los atacantes pueden explotar esto enviando múltiples intentos de autenticación simultáneos para eludir las protecciones de límite de tasa previstas en rutas compatibles con Tailscale."}],"id":"CVE-2026-41913","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41913","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:46:26.346297Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.103","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-25wv-8phj-8p7r"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-rate-limit-bypass-via-concurrent-async-authentication-attempts"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41914.json b/data/2026/CVE-2026-41914.json
index 12fef94ce6..1f80e53c4a 100644
--- a/data/2026/CVE-2026-41914.json
+++ b/data/2026/CVE-2026-41914.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies."}],"id":"CVE-2026-41914","lastModified":"2026-06-17T10:47:11.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41914","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:55:12.970541Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.243","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3fv3-6p2v-gxwj"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-qq-bot-media-fetch-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist policies."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de falsificación de petición del lado del servidor en las rutas de descarga de medios de QQ Bot que elude la protección SSRF. Los atacantes pueden explotar puntos finales de obtención de medios desprotegidos para acceder a recursos internos y eludir las políticas de lista de permitidos."}],"id":"CVE-2026-41914","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41914","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:55:12.970541Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.243","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3fv3-6p2v-gxwj"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-in-qq-bot-media-fetch-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41915.json b/data/2026/CVE-2026-41915.json
index d38ae8af1a..f0d9b5bf01 100644
--- a/data/2026/CVE-2026-41915.json
+++ b/data/2026/CVE-2026-41915.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and compromise repository integrity."}],"id":"CVE-2026-41915","lastModified":"2026-06-17T10:47:11.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41915","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:15:09.008436Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.397","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cm8v-2vh9-cxf3"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-git-environment-variable-injection-via-unfiltered-exec-environment"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit this by setting GIT_DIR and related variables to redirect git operations and compromise repository integrity."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 falla al eliminar las variables de entorno de fontanería de git del entorno de ejecución antes de las operaciones exec del host. Los atacantes pueden explotar esto al establecer GIT_DIR y variables relacionadas para redirigir las operaciones de git y comprometer la integridad del repositorio."}],"id":"CVE-2026-41915","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41915","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:15:09.008436Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.397","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cm8v-2vh9-cxf3"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-git-environment-variable-injection-via-unfiltered-exec-environment"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-41916.json b/data/2026/CVE-2026-41916.json
index deb0d0e07b..6e77c80a46 100644
--- a/data/2026/CVE-2026-41916.json
+++ b/data/2026/CVE-2026-41916.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operations."}],"id":"CVE-2026-41916","lastModified":"2026-06-17T10:47:11.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:00:46.370420Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.540","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-68x5-xx89-w9mm"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-stale-authentication-state-via-config-reload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. Newly accepted gateway connections continue using outdated resolved auth state, allowing attackers to bypass authentication controls through config reload operations."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de gestión del estado de autenticación donde el cierre resolvedAuth queda obsoleto después de una recarga de configuración. Las conexiones de pasarela recién aceptadas continúan utilizando un estado de autenticación resuelto obsoleto, permitiendo a los atacantes eludir los controles de autenticación a través de operaciones de recarga de configuración."}],"id":"CVE-2026-41916","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-41916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T19:00:46.370420Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.540","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-68x5-xx89-w9mm"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-stale-authentication-state-via-config-reload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42198.json b/data/2026/CVE-2026-42198.json
index 3d2a1f4f8d..e614b1b44f 100644
--- a/data/2026/CVE-2026-42198.json
+++ b/data/2026/CVE-2026-42198.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"pgjdbc","vendor":"pgjdbc","versions":[{"status":"affected","version":">= 42.2.0, < 42.7.11"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7.13"],"defaultStatus":"unaffected","packageName":"postgresql","product":"Red Hat AMQ Broker 7.13.6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7.14"],"defaultStatus":"unaffected","packageName":"postgresql","product":"Red Hat AMQ Broker 7.14.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"defaultStatus":"unaffected","packageName":"pgjdbc","product":"Red Hat build of Quarkus 3.27.3.SP2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.7.2-1.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.7.1-7.el10_0.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.14-4.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.3-7.el8_4.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.3-7.el8_4.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.3-5.el8_6.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.6"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.3-5.el8_6.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.14-5.el8_8.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.14-5.el8_8.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.28-2.el9_8.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.28-1.el9_2.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.28-1.el9_4.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.28-1.el9_6.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*","matchCriteriaId":"BC86BFF1-BD22-41C9-9BAB-7C673CBEDB0F","versionEndExcluding":"42.7.11","versionStartIncluding":"42.2.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11."}],"id":"CVE-2026-42198","lastModified":"2026-09-11T13:17:58.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42198","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:00:34.512715Z","version":"2.0.3"}}]},"published":"2026-04-29T16:16:25.427","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19098"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22304"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24348"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25030"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52928"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52929"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52930"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52978"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:54532"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59277"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59278"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-42198"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463857"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-770"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"pgjdbc","vendor":"pgjdbc","versions":[{"status":"affected","version":">= 42.2.0, < 42.7.11"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7.13"],"defaultStatus":"unaffected","packageName":"postgresql","product":"Red Hat AMQ Broker 7.13.6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_broker:7.14"],"defaultStatus":"unaffected","packageName":"postgresql","product":"Red Hat AMQ Broker 7.14.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"defaultStatus":"unaffected","packageName":"pgjdbc","product":"Red Hat build of Quarkus 3.27.3.SP2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.7.2-1.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.7.1-7.el10_0.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.14-4.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.3-7.el8_4.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.3-7.el8_4.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.3-5.el8_6.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.6"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.3-5.el8_6.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.14-5.el8_8.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.14-5.el8_8.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.28-2.el9_8.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.28-1.el9_2.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.28-1.el9_4.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:42.2.28-1.el9_6.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"affected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"postgresql-jdbc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*","matchCriteriaId":"BC86BFF1-BD22-41C9-9BAB-7C673CBEDB0F","versionEndExcluding":"42.7.11","versionStartIncluding":"42.2.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. A malicious server can instruct the driver to perform SCRAM authentication with a very large iteration count. With a large enough value, the client spends an unbounded amount of CPU time inside PBKDF2 before authentication can fail. A single attempt ties up a CPU core. Repeated or concurrent attempts exhaust client CPU and can wedge connection pools. In affected versions, loginTimeout did not fully mitigate this problem. When loginTimeout expired, the caller could stop waiting, but the worker thread performing the connection attempt could continue running and burning CPU inside the SCRAM PBKDF2 computation. This issue has been patched in version 42.7.11."},{"lang":"es","value":"pgjdbc es un controlador JDBC de PostgreSQL de código abierto. Desde la versión 42.2.0 hasta antes de la versión 42.7.11, pgjdbc es vulnerable a una denegación de servicio del lado del cliente durante la autenticación SCRAM-SHA-256. Un servidor malicioso puede instruir al controlador para que realice la autenticación SCRAM con un número de iteraciones muy grande. Con un valor lo suficientemente grande, el cliente gasta una cantidad ilimitada de tiempo de CPU dentro de PBKDF2 antes de que la autenticación pueda fallar. Un solo intento ocupa un núcleo de CPU. Los intentos repetidos o concurrentes agotan la CPU del cliente y pueden atascar los grupos de conexiones. En las versiones afectadas, loginTimeout no mitigó completamente este problema. Cuando loginTimeout expiraba, la persona que llamaba podía dejar de esperar, pero el hilo de trabajo que realizaba el intento de conexión podía seguir ejecutándose y consumiendo CPU dentro del cálculo SCRAM PBKDF2. Este problema ha sido parcheado en la versión 42.7.11."}],"id":"CVE-2026-42198","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42198","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:00:34.512715Z","version":"2.0.3"}}]},"published":"2026-04-29T16:16:25.427","references":[{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/pgjdbc/pgjdbc/releases/tag/REL42.7.11"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19098"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22304"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24348"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25030"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52928"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52929"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52930"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52978"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:54532"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59277"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59278"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-42198"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2463857"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42198.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-770"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42248.json b/data/2026/CVE-2026-42248.json
index 8b2619837c..5f396e1fd1 100644
--- a/data/2026/CVE-2026-42248.json
+++ b/data/2026/CVE-2026-42248.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"Ollama","repo":"https://github.com/ollama/ollama","vendor":"Ollama","versions":[{"lessThanOrEqual":"0.17.5","status":"affected","version":"0.12.10","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*","matchCriteriaId":"17F8EF1F-C63F-4801-84A0-5D2BE7412CCA","versionEndIncluding":"0.17.5","versionStartIncluding":"0.12.10","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success so no digital signature or trust validation is performed before staging or executing update payloads, enabling attacker‑supplied executables to be accepted and later executed by the application.\n\nCritically, Ollama for Windows performs silent automatic updates, so the malicious payload may be installed automatically without user awareness.\n\nMaintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable."}],"id":"CVE-2026-42248","lastModified":"2026-06-17T10:47:34.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:21:11.854543Z","version":"2.0.3"}}]},"published":"2026-04-29T12:16:18.917","references":[{"source":"cvd@cert.pl","tags":["Third Party Advisory"],"url":"https://cert.pl/en/posts/2026/04/CVE-2026-42248/"},{"source":"cvd@cert.pl","tags":["Product"],"url":"https://ollama.com/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"cvd@cert.pl","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"Ollama","repo":"https://github.com/ollama/ollama","vendor":"Ollama","versions":[{"lessThanOrEqual":"0.17.5","status":"affected","version":"0.12.10","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*","matchCriteriaId":"17F8EF1F-C63F-4801-84A0-5D2BE7412CCA","versionEndIncluding":"0.17.5","versionStartIncluding":"0.12.10","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success so no digital signature or trust validation is performed before staging or executing update payloads, enabling attacker‑supplied executables to be accepted and later executed by the application.\n\nCritically, Ollama for Windows performs silent automatic updates, so the malicious payload may be installed automatically without user awareness.\n\nMaintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable."},{"lang":"es","value":"Ollama para Windows no realiza verificación de integridad o autenticidad de los ejecutables de actualización descargados. A diferencia de otras plataformas, la implementación para Windows de la rutina de verificación de actualizaciones devuelve éxito incondicionalmente, por lo que no se realiza ninguna firma digital o validación de confianza antes de la preparación o ejecución de las cargas útiles de actualización, lo que permite que los ejecutables proporcionados por el atacante sean aceptados y posteriormente ejecutados por la aplicación.\n\nCríticamente, Ollama para Windows realiza actualizaciones automáticas silenciosas, por lo que la carga útil maliciosa puede instalarse automáticamente sin el conocimiento del usuario.\n\nLos mantenedores de este proyecto fueron notificados con antelación sobre esta vulnerabilidad, pero no respondieron con los detalles de la vulnerabilidad o el rango de versiones vulnerables. Las versiones de 0.12.10 a 0.17.5 fueron probadas y confirmadas como vulnerables, otras versiones no fueron probadas pero también podrían ser vulnerables."}],"id":"CVE-2026-42248","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:21:11.854543Z","version":"2.0.3"}}]},"published":"2026-04-29T12:16:18.917","references":[{"source":"cvd@cert.pl","tags":["Third Party Advisory"],"url":"https://cert.pl/en/posts/2026/04/CVE-2026-42248/"},{"source":"cvd@cert.pl","tags":["Product"],"url":"https://ollama.com/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-494"}],"source":"cvd@cert.pl","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42249.json b/data/2026/CVE-2026-42249.json
index 900943e00c..95048cb77b 100644
--- a/data/2026/CVE-2026-42249.json
+++ b/data/2026/CVE-2026-42249.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"Ollama","repo":"https://github.com/ollama/ollama","vendor":"Ollama","versions":[{"lessThanOrEqual":"0.17.5","status":"affected","version":"0.12.10","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*","matchCriteriaId":"17F8EF1F-C63F-4801-84A0-5D2BE7412CCA","versionEndIncluding":"0.17.5","versionStartIncluding":"0.12.10","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath.Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory.\nAn attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables.\n\nCritically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and executes staged binaries without user interaction, this results in automatic and persistent code execution without user awareness.\n\nMaintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable."}],"id":"CVE-2026-42249","lastModified":"2026-06-17T10:47:34.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42249","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:20:16.814725Z","version":"2.0.3"}}]},"published":"2026-04-29T12:16:19.113","references":[{"source":"cvd@cert.pl","tags":["Third Party Advisory"],"url":"https://cert.pl/en/posts/2026/04/CVE-2026-42248/"},{"source":"cvd@cert.pl","tags":["Product"],"url":"https://ollama.com/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-494"}],"source":"cvd@cert.pl","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","platforms":["Windows"],"product":"Ollama","repo":"https://github.com/ollama/ollama","vendor":"Ollama","versions":[{"lessThanOrEqual":"0.17.5","status":"affected","version":"0.12.10","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ollama:ollama:*:*:*:*:*:*:*:*","matchCriteriaId":"17F8EF1F-C63F-4801-84A0-5D2BE7412CCA","versionEndIncluding":"0.17.5","versionStartIncluding":"0.12.10","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading updates, the application constructs local file paths using values derived from HTTP headers without validation. These values are passed directly to filepath.Join, allowing path traversal sequences (../) to be resolved and enabling files to be written outside the intended update staging directory.\nAn attacker who can influence update responses can exploit this flaw to write arbitrary executables to attacker‑chosen locations accessible to the current user, including the Windows Startup directory. This allows execution of arbitrary executables.\n\nCritically, when chained with CVE‑2026‑42248 (Missing Signature Verification for Updates), an attacker can deliver malicious payloads that are written to sensitive locations and executed automatically. Because Ollama for Windows performs silent automatic updates and executes staged binaries without user interaction, this results in automatic and persistent code execution without user awareness.\n\nMaintainers of this project were notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Versions from 0.12.10 to 0.17.5 were tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable."},{"lang":"es","value":"Ollama para Windows contiene una vulnerabilidad de ejecución remota de código en su mecanismo de actualización debido a un manejo inadecuado de los encabezados de respuesta HTTP controlados por el atacante. Al descargar actualizaciones, la aplicación construye rutas de archivo locales utilizando valores derivados de los encabezados HTTP sin validación. Estos valores se pasan directamente a filepath.Join, permitiendo que las secuencias de salto de ruta (.. / ) se resuelvan y permitiendo que los archivos se escriban fuera del directorio de preparación de actualizaciones previsto.\nUn atacante que puede influir en las respuestas de actualización puede explotar esta falla para escribir ejecutables arbitrarios en ubicaciones elegidas por el atacante accesibles para el usuario actual, incluyendo el directorio de Inicio de Windows. Esto permite la ejecución de ejecutables arbitrarios.\n\nCríticamente, cuando se encadena con CVE?2026?42248 (Verificación de Firma Faltante para Actualizaciones), un atacante puede entregar cargas útiles maliciosas que se escriben en ubicaciones sensibles y se ejecutan automáticamente. Debido a que Ollama para Windows realiza actualizaciones automáticas silenciosas y ejecuta binarios preparados sin interacción del usuario, esto resulta en una ejecución de código automática y persistente sin el conocimiento del usuario.\n\nLos mantenedores de este proyecto fueron notificados con antelación sobre esta vulnerabilidad, pero no respondieron con los detalles de la vulnerabilidad o el rango de versiones vulnerables. Las versiones de 0.12.10 a 0.17.5 fueron probadas y confirmadas como vulnerables, otras versiones no fueron probadas pero también podrían ser vulnerables."}],"id":"CVE-2026-42249","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42249","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:20:16.814725Z","version":"2.0.3"}}]},"published":"2026-04-29T12:16:19.113","references":[{"source":"cvd@cert.pl","tags":["Third Party Advisory"],"url":"https://cert.pl/en/posts/2026/04/CVE-2026-42248/"},{"source":"cvd@cert.pl","tags":["Product"],"url":"https://ollama.com/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-494"}],"source":"cvd@cert.pl","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42420.json b/data/2026/CVE-2026-42420.json
index 9ce8fb42c8..792f1a7b87 100644
--- a/data/2026/CVE-2026-42420.json
+++ b/data/2026/CVE-2026-42420.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memory exhaustion or denial of service through crafted base64-encoded input."}],"id":"CVE-2026-42420","lastModified":"2026-06-17T10:47:48.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42420","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:47:43.067968Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.680","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ccx3-fw7q-rr2r"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-improper-base64-decoding-size-validation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memory exhaustion or denial of service through crafted base64-encoded input."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una validación de entrada incorrecta en las rutas de decodificación base64 que asignan memoria antes de aplicar los límites de tamaño decodificado. Los atacantes pueden explotar múltiples rutas de código para causar agotamiento de memoria o denegación de servicio mediante una entrada codificada en base64 manipulada."}],"id":"CVE-2026-42420","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42420","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:47:43.067968Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.680","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ccx3-fw7q-rr2r"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-improper-base64-decoding-size-validation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42421.json b/data/2026/CVE-2026-42421.json
index e187c7e2f5..5cff446aad 100644
--- a/data/2026/CVE-2026-42421.json
+++ b/data/2026/CVE-2026-42421.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions."}],"id":"CVE-2026-42421","lastModified":"2026-06-17T10:47:48.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:15:14.531357Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.820","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5h3f-885m-v22w"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-websocket-session-persistence-via-shared-gateway-token-rotation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de gestión de sesiones donde las sesiones WebSocket existentes sobreviven a la rotación de tokens de la pasarela compartida. Los atacantes pueden mantener acceso no autorizado a las conexiones WebSocket después de la rotación de tokens al explotar el fallo al desconectar las sesiones existentes con token compartido."}],"id":"CVE-2026-42421","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:15:14.531357Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.820","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5h3f-885m-v22w"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-websocket-session-persistence-via-shared-gateway-token-rotation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42422.json b/data/2026/CVE-2026-42422.json
index 7d997ade0d..632c62004f 100644
--- a/data/2026/CVE-2026-42422.json
+++ b/data/2026/CVE-2026-42422.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval."}],"id":"CVE-2026-42422","lastModified":"2026-06-17T10:47:48.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42422","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:03:32.200977Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.950","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-whf9-3hcx-gq54"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-role-bypass-in-device-token-rotate-function"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de omisión de rol en la función device.token.rotate que permite la acuñación de tokens para roles no aprobados. Los atacantes pueden omitir el emparejamiento de actualización de rol del dispositivo para preservar o acuñar roles y alcances que no habían pasado por la aprobación prevista."}],"id":"CVE-2026-42422","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42422","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:03:32.200977Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:45.950","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-whf9-3hcx-gq54"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-role-bypass-in-device-token-rotate-function"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42423.json b/data/2026/CVE-2026-42423.json
index f300046fa2..dfd43ee502 100644
--- a/data/2026/CVE-2026-42423.json
+++ b/data/2026/CVE-2026-42423.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended security boundary."}],"id":"CVE-2026-42423","lastModified":"2026-06-17T10:47:48.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:55:43.832507Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.083","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q2gc-xjqw-qp89"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-strictinlineeval-approval-boundary-bypass-via-approval-timeout-fallback"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-636"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended security boundary."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene un mecanismo de reserva por tiempo de espera de aprobación que omite los requisitos de aprobación explícita de strictInlineEval en hosts de ejecución de pasarela y nodo. Los atacantes pueden explotar este respaldo por tiempo de espera para ejecutar comandos de evaluación en línea que deberían requerir aprobación explícita del usuario, eludiendo el límite de seguridad previsto."}],"id":"CVE-2026-42423","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:55:43.832507Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.083","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q2gc-xjqw-qp89"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-strictinlineeval-approval-boundary-bypass-via-approval-timeout-fallback"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-636"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42424.json b/data/2026/CVE-2026-42424.json
index 3e324d747e..41cab62625 100644
--- a/data/2026/CVE-2026-42424.json
+++ b/data/2026/CVE-2026-42424.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause another channel to read local file paths as trusted generated media."}],"id":"CVE-2026-42424","lastModified":"2026-06-17T10:47:48.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42424","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:12:58.383706Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.217","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qqq7-4hxc-x63c"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-local-file-exfiltration-via-shared-reply-media-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause another channel to read local file paths as trusted generated media."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 trata las rutas MEDIA de respuesta compartida como de confianza, permitiendo que referencias manipuladas desencadenen la exfiltración de archivos locales entre canales. Los atacantes pueden explotar esto creando referencias MEDIA de respuesta compartida maliciosas para hacer que otro canal lea rutas de archivos locales como medios generados de confianza."}],"id":"CVE-2026-42424","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42424","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:12:58.383706Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.217","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qqq7-4hxc-x63c"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-local-file-exfiltration-via-shared-reply-media-paths"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42426.json b/data/2026/CVE-2026-42426.json
index f542bb3cac..5a02776831 100644
--- a/data/2026/CVE-2026-42426.json
+++ b/data/2026/CVE-2026-42426.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairing approval restrictions to gain unauthorized access to exec-capable nodes."}],"id":"CVE-2026-42426","lastModified":"2026-06-17T10:47:49.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:25:43.985590Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.360","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-67mf-f936-ppxf"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-improper-authorization-in-node-pair-approve-via-operator-write-scope"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairing approval restrictions to gain unauthorized access to exec-capable nodes."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de autorización indebida donde el método node.pair.approve acepta el alcance operator.write en lugar del alcance más restringido operator.pairing, permitiendo a usuarios no privilegiados aprobar el emparejamiento de nodos. Atacantes con permisos operator.write pueden eludir las restricciones de aprobación de emparejamiento para obtener acceso no autorizado a nodos con capacidad de ejecución."}],"id":"CVE-2026-42426","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:25:43.985590Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.360","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-67mf-f936-ppxf"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-improper-authorization-in-node-pair-approve-via-operator-write-scope"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42427.json b/data/2026/CVE-2026-42427.json
index e856a42f59..7388af0a56 100644
--- a/data/2026/CVE-2026-42427.json
+++ b/data/2026/CVE-2026-42427.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. Attackers can inject malicious build tool environment variables to influence host exec commands and achieve arbitrary code execution."}],"id":"CVE-2026-42427","lastModified":"2026-06-17T10:47:49.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:47:54.771084Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.493","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7437-7hg8-frrw"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-build-tool-environment-variable-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. Attackers can inject malicious build tool environment variables to influence host exec commands and achieve arbitrary code execution."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de ejecución remota de código causada por la falta de entradas en la lista de denegación de variables de entorno para HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER y MAKEFLAGS. Los atacantes pueden inyectar variables de entorno maliciosas de herramientas de compilación para influir en los comandos exec del host y lograr la ejecución de código arbitrario."}],"id":"CVE-2026-42427","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T14:47:54.771084Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.493","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7437-7hg8-frrw"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-build-tool-environment-variable-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42428.json b/data/2026/CVE-2026-42428.json
index c187ce74ec..71b16cb469 100644
--- a/data/2026/CVE-2026-42428.json
+++ b/data/2026/CVE-2026-42428.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment."}],"id":"CVE-2026-42428","lastModified":"2026-06-17T10:47:49.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42428","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:14:40.882278Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.630","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3vvq-q2qc-7rmp"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-missing-integrity-verification-in-package-downloads"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-353"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment."},{"lang":"es","value":"Las versiones de OpenClaw anteriores a la 2026.4.8 no aplican la verificación de integridad en los archivos de plugin descargados. Los atacantes pueden instalar paquetes de plugin maliciosos o manipulados sin ser detectados, comprometiendo el entorno del asistente local."}],"id":"CVE-2026-42428","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42428","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T12:14:40.882278Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.630","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3vvq-q2qc-7rmp"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-missing-integrity-verification-in-package-downloads"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-353"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42429.json b/data/2026/CVE-2026-42429.json
index c0a379e6bc..a10db049dc 100644
--- a/data/2026/CVE-2026-42429.json
+++ b/data/2026/CVE-2026-42429.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.read requests to runtime operator.write permissions. Attackers can exploit this by sending read-scoped requests through the gateway auth route to gain unauthorized write access to runtime operations."}],"id":"CVE-2026-42429","lastModified":"2026-06-17T10:47:49.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42429","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:09:14.614465Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.773","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4f8g-77mw-3rxc"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-gateway-plugin-http-authentication"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.read requests to runtime operator.write permissions. Attackers can exploit this by sending read-scoped requests through the gateway auth route to gain unauthorized write access to runtime operations."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de escalada de privilegios en el mecanismo de autenticación HTTP del plugin de la pasarela que amplía las solicitudes operator.read con identidad a permisos operator.write en tiempo de ejecución. Los atacantes pueden explotar esto enviando solicitudes con alcance de lectura a través de la ruta de autenticación de la pasarela para obtener acceso de escritura no autorizado a las operaciones en tiempo de ejecución."}],"id":"CVE-2026-42429","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42429","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-29T13:09:14.614465Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:46.773","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4f8g-77mw-3rxc"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-gateway-plugin-http-authentication"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42432.json b/data/2026/CVE-2026-42432.json
index de96bbb3c7..22b772fb6c 100644
--- a/data/2026/CVE-2026-42432.json
+++ b/data/2026/CVE-2026-42432.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute privileged commands on the local assistant system."}],"id":"CVE-2026-42432","lastModified":"2026-06-17T10:47:49.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:17:47.065246Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:47.190","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5wj5-87vq-39xm"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-command-escalation-via-node-pairing-reconnect-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.8","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.8","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"37A0977C-2C03-4821-B459-0FD7E4A6635A","versionEndExcluding":"2026.4.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute privileged commands on the local assistant system."},{"lang":"es","value":"OpenClaw anterior a 2026.4.8 contiene una vulnerabilidad de escalada de privilegios que permite a los nodos previamente emparejados reconectarse con comandos con capacidad de ejecución sin el requisito de alcance operator.admin. Los atacantes pueden eludir la autenticación de re-emparejamiento para ejecutar comandos privilegiados en el sistema asistente local."}],"id":"CVE-2026-42432","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T18:17:47.065246Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:47.190","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5wj5-87vq-39xm"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-command-escalation-via-node-pairing-reconnect-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42482.json b/data/2026/CVE-2026-42482.json
index 0e45cf768e..d26f205b68 100644
--- a/data/2026/CVE-2026-42482.json
+++ b/data/2026/CVE-2026-42482.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashcat:hashcat:7.1.2:*:*:*:*:*:*:*","matchCriteriaId":"E1ECAF10-13E9-4F40-973C-EBC2BC0CDA88","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in src/rp_cpu.c in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted rule file, or via the -j or -k rule options used with password candidates of 128 or more characters. The vulnerability is caused by a bounds check that fails to account for the 2x expansion that occurs when password bytes are converted to hexadecimal."}],"id":"CVE-2026-42482","lastModified":"2026-06-17T10:47:55.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42482","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T18:36:37.374606Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:22.577","references":[{"source":"cve@mitre.org","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashcat:hashcat:7.1.2:*:*:*:*:*:*:*","matchCriteriaId":"E1ECAF10-13E9-4F40-973C-EBC2BC0CDA88","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in src/rp_cpu.c in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted rule file, or via the -j or -k rule options used with password candidates of 128 or more characters. The vulnerability is caused by a bounds check that fails to account for the 2x expansion that occurs when password bytes are converted to hexadecimal."},{"lang":"es","value":"Un desbordamiento de búfer basado en pila en mangle_to_hex_lower() y mangle_to_hex_upper() en src/rp_cpu.c en hashcat v7.1.2 permite a un atacante causar una denegación de servicio o posiblemente ejecutar código arbitrario a través de un archivo de reglas manipulado, o a través de las opciones de reglas -j o -k utilizadas con candidatos de contraseña de 128 o más caracteres. La vulnerabilidad es causada por una comprobación de límites que no tiene en cuenta la expansión 2x que ocurre cuando los bytes de la contraseña se convierten a hexadecimal."}],"id":"CVE-2026-42482","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42482","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T18:36:37.374606Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:22.577","references":[{"source":"cve@mitre.org","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42483.json b/data/2026/CVE-2026-42483.json
index 0a8e1086ea..9f3a42fc8c 100644
--- a/data/2026/CVE-2026-42483.json
+++ b/data/2026/CVE-2026-42483.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashcat:hashcat:7.1.2:*:*:*:*:*:*:*","matchCriteriaId":"E1ECAF10-13E9-4F40-973C-EBC2BC0CDA88","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted Kerberos hash file. The issue affects module_hash_decode in multiple Kerberos-related modules because account_info_len is calculated from untrusted delimiter positions without upper-bound validation before memcpy copies the data into a fixed-size account_info buffer."}],"id":"CVE-2026-42483","lastModified":"2026-06-17T10:47:55.307","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42483","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T17:34:36.104014Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:22.687","references":[{"source":"cve@mitre.org","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashcat:hashcat:7.1.2:*:*:*:*:*:*:*","matchCriteriaId":"E1ECAF10-13E9-4F40-973C-EBC2BC0CDA88","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted Kerberos hash file. The issue affects module_hash_decode in multiple Kerberos-related modules because account_info_len is calculated from untrusted delimiter positions without upper-bound validation before memcpy copies the data into a fixed-size account_info buffer."},{"lang":"es","value":"Un desbordamiento de búfer basado en montículo en el analizador de hashes de Kerberos en hashcat v7.1.2 permite a un atacante causar una denegación de servicio o posiblemente ejecutar código arbitrario a través de un archivo de hash de Kerberos manipulado. El problema afecta a module_hash_decode en múltiples módulos relacionados con Kerberos porque account_info_len se calcula a partir de posiciones de delimitador no confiables sin validación de límite superior antes de que memcpy copie los datos en un búfer account_info de tamaño fijo."}],"id":"CVE-2026-42483","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42483","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T17:34:36.104014Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:22.687","references":[{"source":"cve@mitre.org","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42484.json b/data/2026/CVE-2026-42484.json
index c46d4c056e..8220190054 100644
--- a/data/2026/CVE-2026-42484.json
+++ b/data/2026/CVE-2026-42484.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashcat:hashcat:7.1.2:*:*:*:*:*:*:*","matchCriteriaId":"E1ECAF10-13E9-4F40-973C-EBC2BC0CDA88","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted PKZIP hash file. The issue affects modules 17200, 17210, 17220, 17225, and 17230. When data_type_enum<=1, attacker-controlled hex data from a user-supplied hash string is decoded into a fixed-size buffer without proper input-length validation."}],"id":"CVE-2026-42484","lastModified":"2026-06-17T10:47:55.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42484","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T18:34:31.862474Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:22.800","references":[{"source":"cve@mitre.org","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hashcat:hashcat:7.1.2:*:*:*:*:*:*:*","matchCriteriaId":"E1ECAF10-13E9-4F40-973C-EBC2BC0CDA88","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted PKZIP hash file. The issue affects modules 17200, 17210, 17220, 17225, and 17230. When data_type_enum<=1, attacker-controlled hex data from a user-supplied hash string is decoded into a fixed-size buffer without proper input-length validation."},{"lang":"es","value":"Un desbordamiento de búfer basado en montículo en hex_to_binary en el analizador de hashes PKZIP en hashcat v7.1.2 permite a un atacante causar una denegación de servicio o posiblemente ejecutar código arbitrario a través de un archivo de hash PKZIP manipulado. El problema afecta a los módulos 17200, 17210, 17220, 17225 y 17230. Cuando data_type_enummenor o igual que 1, los datos hexadecimales controlados por el atacante de una cadena de hash proporcionada por el usuario se decodifican en un búfer de tamaño fijo sin una validación adecuada de la longitud de entrada."}],"id":"CVE-2026-42484","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42484","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T18:34:31.862474Z","version":"2.0.3"}}]},"published":"2026-05-01T14:16:22.800","references":[{"source":"cve@mitre.org","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42511.json b/data/2026/CVE-2026-42511.json
index dfab144ee2..fc7c0e63f6 100644
--- a/data/2026/CVE-2026-42511.json
+++ b/data/2026/CVE-2026-42511.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["dhclient"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives.  When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it.\n\nA rogue DHCP server may be able to execute arbirary code as root on a system running dhclient."}],"id":"CVE-2026-42511","lastModified":"2026-06-17T10:47:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T03:55:55.336127Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:37.290","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-149"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["dhclient"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives.  When the lease file is subsequently re-parsed by dhclient, e.g., after a system restart, an attacker-controlled field from the lease is passed to dhclient-script(8), which evaluates it.\n\nA rogue DHCP server may be able to execute arbirary code as root on a system running dhclient."},{"lang":"es","value":"El campo de archivo BOOTP se escribe en el archivo de concesión sin escapar las comillas dobles incrustadas, permitiendo la inyección de directivas dhclient.conf arbitrarias. Cuando el archivo de concesión es posteriormente re-analizado por dhclient, por ejemplo, después de un reinicio del sistema, un campo controlado por el atacante de la concesión se pasa a dhclient-script(8), que lo evalúa.\n\nUn servidor DHCP malicioso podría ejecutar código arbitrario como root en un sistema que ejecuta dhclient."}],"id":"CVE-2026-42511","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T03:55:55.336127Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:37.290","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:12.dhclient.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-149"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42512.json b/data/2026/CVE-2026-42512.json
index 7441cdcddf..a2758cb724 100644
--- a/data/2026/CVE-2026-42512.json
+++ b/data/2026/CVE-2026-42512.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["dhclient"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers.  The code which expands the array incorrectly calculates its new size when requesting memory, resulting in a heap buffer overrun.\n\nA specially crafted packet can cause dhclient to overrun its buffer of environment entries.  This can result in a crash, but it may be possible to leverage this bug to achieve remote code execution."}],"id":"CVE-2026-42512","lastModified":"2026-06-17T10:47:57.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T03:55:53.107126Z","version":"2.0.3"}}]},"published":"2026-04-30T09:16:03.373","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:15.dhclient.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["dhclient"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers.  The code which expands the array incorrectly calculates its new size when requesting memory, resulting in a heap buffer overrun.\n\nA specially crafted packet can cause dhclient to overrun its buffer of environment entries.  This can result in a crash, but it may be possible to leverage this bug to achieve remote code execution."},{"lang":"es","value":"Mientras dhclient está construyendo un entorno para pasar a dhclient-script, puede necesitar redimensionar el array de punteros de cadena. El código que expande el array calcula incorrectamente su nuevo tamaño al solicitar memoria, lo que resulta en un desbordamiento de búfer de pila.\n\nUn paquete especialmente diseñado puede causar que dhclient desborde su búfer de entradas de entorno. Esto puede resultar en un fallo, pero puede ser posible aprovechar este error para lograr ejecución remota de código."}],"id":"CVE-2026-42512","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T03:55:53.107126Z","version":"2.0.3"}}]},"published":"2026-04-30T09:16:03.373","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:15.dhclient.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43059.json b/data/2026/CVE-2026-43059.json
index 1794804ec7..ed0b515b39 100644
--- a/data/2026/CVE-2026-43059.json
+++ b/data/2026/CVE-2026-43059.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3d6de8467236cd763ddc7d06127689bdfbfbd8ff","status":"affected","version":"0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a","versionType":"git"},{"lessThan":"695b45b2262fcb5e71bed1175aad59c72f92aa78","status":"affected","version":"d71b98f253b079cbadc83266383f26fe7e9e103b","versionType":"git"},{"lessThan":"b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"lessThan":"02023ff760cc104a5d86a82ef5b8dd89098ad78d","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"lessThan":"17f89341cb4281d1da0e2fb0de5406ab7c4e25ef","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"status":"affected","version":"87a1f16f07c6c43771754075e08f45b41d237421","versionType":"git"},{"lessThan":"6.6.160","status":"affected","version":"6.6.140","versionType":"semver"},{"lessThan":"6.12.78","status":"affected","version":"6.12.59","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"432FEB2A-EE4B-41CC-BD3B-22D6680FA2AC","versionEndExcluding":"6.7","versionStartIncluding":"6.6.140","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C6E44F9-3E53-4331-A4D5-B31041365D22","versionEndExcluding":"6.12.78","versionStartIncluding":"6.12.59","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C91278E-7FC3-4EFB-AE2C-E82D42F4D3AA","versionEndExcluding":"6.17","versionStartIncluding":"6.16.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7ED31AF6-5D81-4EE0-84BE-89EDBCE41784","versionEndExcluding":"6.18.20","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix list corruption and UAF in command complete handlers\n\nCommit 302a1f674c00 (\"Bluetooth: MGMT: Fix possible UAFs\") introduced\nmgmt_pending_valid(), which not only validates the pending command but\nalso unlinks it from the pending list if it is valid. This change in\nsemantics requires updates to several completion handlers to avoid list\ncorruption and memory safety issues.\n\nThis patch addresses two left-over issues from the aforementioned rework:\n\n1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove()\nis replaced with mgmt_pending_free() in the success path. Since\nmgmt_pending_valid() already unlinks the command at the beginning of\nthe function, calling mgmt_pending_remove() leads to a double list_del()\nand subsequent list corruption/kernel panic.\n\n2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error\npath is removed. Since the current command is already unlinked by\nmgmt_pending_valid(), this foreach loop would incorrectly target other\npending mesh commands, potentially freeing them while they are still being\nprocessed concurrently (leading to UAFs). The redundant mgmt_cmd_status()\nis also simplified to use cmd->opcode directly."}],"id":"CVE-2026-43059","lastModified":"2026-11-06T16:18:19.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43059","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:32.990418Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:14.927","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02023ff760cc104a5d86a82ef5b8dd89098ad78d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/17f89341cb4281d1da0e2fb0de5406ab7c4e25ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3d6de8467236cd763ddc7d06127689bdfbfbd8ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/695b45b2262fcb5e71bed1175aad59c72f92aa78"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3d6de8467236cd763ddc7d06127689bdfbfbd8ff","status":"affected","version":"0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a","versionType":"git"},{"lessThan":"695b45b2262fcb5e71bed1175aad59c72f92aa78","status":"affected","version":"d71b98f253b079cbadc83266383f26fe7e9e103b","versionType":"git"},{"lessThan":"b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"lessThan":"02023ff760cc104a5d86a82ef5b8dd89098ad78d","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"lessThan":"17f89341cb4281d1da0e2fb0de5406ab7c4e25ef","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"status":"affected","version":"87a1f16f07c6c43771754075e08f45b41d237421","versionType":"git"},{"lessThan":"6.6.160","status":"affected","version":"6.6.140","versionType":"semver"},{"lessThan":"6.12.78","status":"affected","version":"6.12.59","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"432FEB2A-EE4B-41CC-BD3B-22D6680FA2AC","versionEndExcluding":"6.7","versionStartIncluding":"6.6.140","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C6E44F9-3E53-4331-A4D5-B31041365D22","versionEndExcluding":"6.12.78","versionStartIncluding":"6.12.59","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C91278E-7FC3-4EFB-AE2C-E82D42F4D3AA","versionEndExcluding":"6.17","versionStartIncluding":"6.16.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7ED31AF6-5D81-4EE0-84BE-89EDBCE41784","versionEndExcluding":"6.18.20","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix list corruption and UAF in command complete handlers\n\nCommit 302a1f674c00 (\"Bluetooth: MGMT: Fix possible UAFs\") introduced\nmgmt_pending_valid(), which not only validates the pending command but\nalso unlinks it from the pending list if it is valid. This change in\nsemantics requires updates to several completion handlers to avoid list\ncorruption and memory safety issues.\n\nThis patch addresses two left-over issues from the aforementioned rework:\n\n1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove()\nis replaced with mgmt_pending_free() in the success path. Since\nmgmt_pending_valid() already unlinks the command at the beginning of\nthe function, calling mgmt_pending_remove() leads to a double list_del()\nand subsequent list corruption/kernel panic.\n\n2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error\npath is removed. Since the current command is already unlinked by\nmgmt_pending_valid(), this foreach loop would incorrectly target other\npending mesh commands, potentially freeing them while they are still being\nprocessed concurrently (leading to UAFs). The redundant mgmt_cmd_status()\nis also simplified to use cmd->opcode directly."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: MGMT: Corrección de corrupción de lista y UAF en los manejadores de finalización de comandos\n\nEl commit 302a1f674c00 (’Bluetooth: MGMT: Corrección de posibles UAF’) introdujo mgmt_pending_valid(), que no solo valida el comando pendiente sino que también lo desvincula de la lista de pendientes si es válido. Este cambio en la semántica requiere actualizaciones en varios manejadores de finalización para evitar la corrupción de la lista y problemas de seguridad de la memoria.\n\nEste parche aborda dos problemas restantes del rediseño mencionado:\n\n1. En mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove() es reemplazado por mgmt_pending_free() en la ruta de éxito. Dado que mgmt_pending_valid() ya desvincula el comando al principio de la función, llamar a mgmt_pending_remove() conduce a un doble list_del() y a la subsiguiente corrupción de la lista/kernel panic.\n\n2. En set_mesh_complete(), el uso de mgmt_pending_foreach() en la ruta de error es eliminado. Dado que el comando actual ya está desvinculado por mgmt_pending_valid(), este bucle foreach apuntaría incorrectamente a otros comandos mesh pendientes, potencialmente liberándolos mientras aún están siendo procesados concurrentemente (lo que lleva a UAF). El mgmt_cmd_status() redundante también se simplifica para usar cmd  ->  opcode directamente."}],"id":"CVE-2026-43059","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43059","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:32.990418Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:14.927","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02023ff760cc104a5d86a82ef5b8dd89098ad78d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/17f89341cb4281d1da0e2fb0de5406ab7c4e25ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3d6de8467236cd763ddc7d06127689bdfbfbd8ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/695b45b2262fcb5e71bed1175aad59c72f92aa78"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43060.json b/data/2026/CVE-2026-43060.json
index 0a1c32d982..858c9004e3 100644
--- a/data/2026/CVE-2026-43060.json
+++ b/data/2026/CVE-2026-43060.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8a64e76933672b08bd85b63086f33432070fd729","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"3da0b946835f33bf36b459ead764c61a761e689b","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"ab50302190b303f847c4eba0e31a01a56dec596e","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"e68a8db3a0546482b34e9ca5ca886bcf73eb37bb","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"6802ff8beceb9c4254318e81c1395720438f2cc2","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"f29a055e4f593e577805b41228b142b58f48df1b","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"77da55dee67720e2b8d2db49a53334e6c017ee7b","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"36eae0956f659e48d5366d9b083d9417f3263ddc","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8DA957C-C958-43FF-BB9F-975A326709F9","versionEndExcluding":"5.10.253","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: drop pending enqueued packets on removal\n\nPackets sitting in nfqueue might hold a reference to:\n\n- templates that specify the conntrack zone, because a percpu area is\n  used and module removal is possible.\n- conntrack timeout policies and helper, where object removal leave\n  a stale reference.\n\nSince these objects can just go away, drop enqueued packets to avoid\nstale reference to them.\n\nIf there is a need for finer grain removal, this logic can be revisited\nto make selective packet drop upon dependencies."}],"id":"CVE-2026-43060","lastModified":"2026-10-19T20:18:03.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43060","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:09.661568Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.050","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36eae0956f659e48d5366d9b083d9417f3263ddc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3da0b946835f33bf36b459ead764c61a761e689b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6802ff8beceb9c4254318e81c1395720438f2cc2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77da55dee67720e2b8d2db49a53334e6c017ee7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a64e76933672b08bd85b63086f33432070fd729"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab50302190b303f847c4eba0e31a01a56dec596e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e68a8db3a0546482b34e9ca5ca886bcf73eb37bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f29a055e4f593e577805b41228b142b58f48df1b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8a64e76933672b08bd85b63086f33432070fd729","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"3da0b946835f33bf36b459ead764c61a761e689b","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"ab50302190b303f847c4eba0e31a01a56dec596e","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"e68a8db3a0546482b34e9ca5ca886bcf73eb37bb","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"6802ff8beceb9c4254318e81c1395720438f2cc2","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"f29a055e4f593e577805b41228b142b58f48df1b","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"77da55dee67720e2b8d2db49a53334e6c017ee7b","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"36eae0956f659e48d5366d9b083d9417f3263ddc","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8DA957C-C958-43FF-BB9F-975A326709F9","versionEndExcluding":"5.10.253","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: drop pending enqueued packets on removal\n\nPackets sitting in nfqueue might hold a reference to:\n\n- templates that specify the conntrack zone, because a percpu area is\n  used and module removal is possible.\n- conntrack timeout policies and helper, where object removal leave\n  a stale reference.\n\nSince these objects can just go away, drop enqueued packets to avoid\nstale reference to them.\n\nIf there is a need for finer grain removal, this logic can be revisited\nto make selective packet drop upon dependencies."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nft_ct: descartar paquetes pendientes en cola al eliminar\n\nLos paquetes que residen en nfqueue podrían mantener una referencia a:\n\n- plantillas que especifican la zona conntrack, porque se utiliza un área percpu y la eliminación del módulo es posible.\n- políticas de tiempo de espera de conntrack y el ayudante, donde la eliminación de objetos deja una referencia obsoleta.\n\nDado que estos objetos pueden simplemente desaparecer, se descartan los paquetes en cola para evitar referencias obsoletas a ellos.\n\nSi existe la necesidad de una eliminación más granular, esta lógica puede ser revisada para realizar un descarte selectivo de paquetes según las dependencias."}],"id":"CVE-2026-43060","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43060","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:09.661568Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.050","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36eae0956f659e48d5366d9b083d9417f3263ddc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3da0b946835f33bf36b459ead764c61a761e689b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6802ff8beceb9c4254318e81c1395720438f2cc2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77da55dee67720e2b8d2db49a53334e6c017ee7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a64e76933672b08bd85b63086f33432070fd729"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab50302190b303f847c4eba0e31a01a56dec596e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e68a8db3a0546482b34e9ca5ca886bcf73eb37bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f29a055e4f593e577805b41228b142b58f48df1b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43061.json b/data/2026/CVE-2026-43061.json
index dc57d537af..eb7cc4a24a 100644
--- a/data/2026/CVE-2026-43061.json
+++ b/data/2026/CVE-2026-43061.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/serial/8250/8250_dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8190f9ab6ad90cb97652adbebd238b874a4ef70d","status":"affected","version":"7c47e637dfadfbc691dd297b91d81ef939ca2080","versionType":"git"},{"lessThan":"79a19bd936bb35f56ef0ccab1b3b59ebce8c762d","status":"affected","version":"bf3f395b9c37956eca866c9e1679769ed7dcce68","versionType":"git"},{"lessThan":"f76d91271bcacbd759a2e4ee3ea61faa6a727ccf","status":"affected","version":"d470522c597b73e63cca04f3012aec28185113b7","versionType":"git"},{"lessThan":"d2719a0a9c3439abf67843a5504b7afccd9ded93","status":"affected","version":"5e00346deb7bf40a4cf70e3716ac8e9a2409eb55","versionType":"git"},{"lessThan":"2a72403b985aea6b4aac3171830492f9a387f9e1","status":"affected","version":"c8a52c772c7c6de72257a435bcad03d3bb914a70","versionType":"git"},{"lessThan":"5f6b17562f03fc65c7d3474ef8f1959b19d1ca41","status":"affected","version":"9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583","versionType":"git"},{"lessThan":"b5ad887339503103d0fbe9827b16ad287597c275","status":"affected","version":"9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583","versionType":"git"},{"lessThan":"a424a34b8faddf97b5af41689087e7a230f79ba7","status":"affected","version":"9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583","versionType":"git"},{"status":"affected","version":"bbec5998d7bd349730f59c959a8b00cfff816e34","versionType":"git"},{"status":"affected","version":"59f751db7f392fa7a58cbd972205982f7f4f5854","versionType":"git"},{"lessThan":"5.10.253","status":"affected","version":"5.10.235","versionType":"semver"},{"lessThan":"5.15.203","status":"affected","version":"5.15.179","versionType":"semver"},{"lessThan":"6.1.167","status":"affected","version":"6.1.129","versionType":"semver"},{"lessThan":"6.6.130","status":"affected","version":"6.6.79","versionType":"semver"},{"lessThan":"6.12.78","status":"affected","version":"6.12.16","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.291","versionType":"semver"},{"lessThan":"6.14","status":"affected","version":"6.13.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/tty/serial/8250/8250_dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2082E874-B9D3-4B60-9D27-1F3B8A838CD0","versionEndExcluding":"5.5","versionStartIncluding":"5.4.291","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F53D37DD-08CD-45E7-AC64-89E784643461","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10.235","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1758EB5F-A1C9-49BD-9D44-664C553093C0","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.179","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AE7F8BC2-4A4D-4682-B175-709BD87448F7","versionEndExcluding":"6.1.167","versionStartIncluding":"6.1.129","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1AA2DD10-BE5C-4C34-9E74-B73AA999FFFB","versionEndExcluding":"6.6.130","versionStartIncluding":"6.6.79","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7733838E-2319-4A21-8D00-83A7B7B008BF","versionEndExcluding":"6.12.78","versionStartIncluding":"6.12.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D76AB7DD-087E-411C-AD59-C015F85930A7","versionEndExcluding":"6.14","versionStartIncluding":"6.13.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BD54E28E-E5DD-4B1B-9B3C-D90CA91313C7","versionEndExcluding":"6.18.20","versionStartIncluding":"6.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*","matchCriteriaId":"7DE421BA-0600-4401-A175-73CAB6A6FB4E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*","matchCriteriaId":"66619FB8-0AAF-4166-B2CF-67B24143261D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*","matchCriteriaId":"D3D6550E-6679-4560-902D-AF52DCFE905B","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*","matchCriteriaId":"45B90F6B-BEC7-4D4E-883A-9DBADE021750","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*","matchCriteriaId":"1759FFB7-531C-41B1-9AE1-FD3D80E0D920","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*","matchCriteriaId":"AD948719-8628-4421-A340-1066314BBD4A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: Fix TX deadlock when using DMA\n\n`dmaengine_terminate_async` does not guarantee that the\n`__dma_tx_complete` callback will run. The callback is currently the\nonly place where `dma->tx_running` gets cleared. If the transaction is\ncanceled and the callback never runs, then `dma->tx_running` will never\nget cleared and we will never schedule new TX DMA transactions again.\n\nThis change makes it so we clear `dma->tx_running` after we terminate\nthe DMA transaction. This is \"safe\" because `serial8250_tx_dma_flush`\nis holding the UART port lock. The first thing the callback does is also\ngrab the UART port lock, so access to `dma->tx_running` is serialized."}],"id":"CVE-2026-43061","lastModified":"2026-11-06T16:18:20.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:37.230216Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.210","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a72403b985aea6b4aac3171830492f9a387f9e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5f6b17562f03fc65c7d3474ef8f1959b19d1ca41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79a19bd936bb35f56ef0ccab1b3b59ebce8c762d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8190f9ab6ad90cb97652adbebd238b874a4ef70d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a424a34b8faddf97b5af41689087e7a230f79ba7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5ad887339503103d0fbe9827b16ad287597c275"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2719a0a9c3439abf67843a5504b7afccd9ded93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f76d91271bcacbd759a2e4ee3ea61faa6a727ccf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/serial/8250/8250_dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8190f9ab6ad90cb97652adbebd238b874a4ef70d","status":"affected","version":"7c47e637dfadfbc691dd297b91d81ef939ca2080","versionType":"git"},{"lessThan":"79a19bd936bb35f56ef0ccab1b3b59ebce8c762d","status":"affected","version":"bf3f395b9c37956eca866c9e1679769ed7dcce68","versionType":"git"},{"lessThan":"f76d91271bcacbd759a2e4ee3ea61faa6a727ccf","status":"affected","version":"d470522c597b73e63cca04f3012aec28185113b7","versionType":"git"},{"lessThan":"d2719a0a9c3439abf67843a5504b7afccd9ded93","status":"affected","version":"5e00346deb7bf40a4cf70e3716ac8e9a2409eb55","versionType":"git"},{"lessThan":"2a72403b985aea6b4aac3171830492f9a387f9e1","status":"affected","version":"c8a52c772c7c6de72257a435bcad03d3bb914a70","versionType":"git"},{"lessThan":"5f6b17562f03fc65c7d3474ef8f1959b19d1ca41","status":"affected","version":"9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583","versionType":"git"},{"lessThan":"b5ad887339503103d0fbe9827b16ad287597c275","status":"affected","version":"9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583","versionType":"git"},{"lessThan":"a424a34b8faddf97b5af41689087e7a230f79ba7","status":"affected","version":"9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583","versionType":"git"},{"status":"affected","version":"bbec5998d7bd349730f59c959a8b00cfff816e34","versionType":"git"},{"status":"affected","version":"59f751db7f392fa7a58cbd972205982f7f4f5854","versionType":"git"},{"lessThan":"5.10.253","status":"affected","version":"5.10.235","versionType":"semver"},{"lessThan":"5.15.203","status":"affected","version":"5.15.179","versionType":"semver"},{"lessThan":"6.1.167","status":"affected","version":"6.1.129","versionType":"semver"},{"lessThan":"6.6.130","status":"affected","version":"6.6.79","versionType":"semver"},{"lessThan":"6.12.78","status":"affected","version":"6.12.16","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.291","versionType":"semver"},{"lessThan":"6.14","status":"affected","version":"6.13.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/tty/serial/8250/8250_dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2082E874-B9D3-4B60-9D27-1F3B8A838CD0","versionEndExcluding":"5.5","versionStartIncluding":"5.4.291","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F53D37DD-08CD-45E7-AC64-89E784643461","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10.235","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1758EB5F-A1C9-49BD-9D44-664C553093C0","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.179","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AE7F8BC2-4A4D-4682-B175-709BD87448F7","versionEndExcluding":"6.1.167","versionStartIncluding":"6.1.129","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1AA2DD10-BE5C-4C34-9E74-B73AA999FFFB","versionEndExcluding":"6.6.130","versionStartIncluding":"6.6.79","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7733838E-2319-4A21-8D00-83A7B7B008BF","versionEndExcluding":"6.12.78","versionStartIncluding":"6.12.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D76AB7DD-087E-411C-AD59-C015F85930A7","versionEndExcluding":"6.14","versionStartIncluding":"6.13.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BD54E28E-E5DD-4B1B-9B3C-D90CA91313C7","versionEndExcluding":"6.18.20","versionStartIncluding":"6.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*","matchCriteriaId":"7DE421BA-0600-4401-A175-73CAB6A6FB4E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*","matchCriteriaId":"66619FB8-0AAF-4166-B2CF-67B24143261D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*","matchCriteriaId":"D3D6550E-6679-4560-902D-AF52DCFE905B","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*","matchCriteriaId":"45B90F6B-BEC7-4D4E-883A-9DBADE021750","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*","matchCriteriaId":"1759FFB7-531C-41B1-9AE1-FD3D80E0D920","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*","matchCriteriaId":"AD948719-8628-4421-A340-1066314BBD4A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: Fix TX deadlock when using DMA\n\n`dmaengine_terminate_async` does not guarantee that the\n`__dma_tx_complete` callback will run. The callback is currently the\nonly place where `dma->tx_running` gets cleared. If the transaction is\ncanceled and the callback never runs, then `dma->tx_running` will never\nget cleared and we will never schedule new TX DMA transactions again.\n\nThis change makes it so we clear `dma->tx_running` after we terminate\nthe DMA transaction. This is \"safe\" because `serial8250_tx_dma_flush`\nis holding the UART port lock. The first thing the callback does is also\ngrab the UART port lock, so access to `dma->tx_running` is serialized."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nserial: 8250: Corrige el interbloqueo de TX al usar DMA\n\n’dmaengine_terminate_async’ no garantiza que la función de devolución de llamada ’__dma_tx_complete’ se ejecute. La función de devolución de llamada es actualmente el único lugar donde ’dma  ->  tx_running’ se borra. Si la transacción se cancela y la función de devolución de llamada nunca se ejecuta, entonces ’dma  ->  tx_running’ nunca se borrará y nunca volveremos a programar nuevas transacciones TX DMA.\n\nEste cambio hace que borremos ’dma  ->  tx_running’ después de terminar la transacción DMA. Esto es “seguro” porque ’serial8250_tx_dma_flush’ está manteniendo el bloqueo del puerto UART. Lo primero que hace la función de devolución de llamada es también tomar el bloqueo del puerto UART, por lo que el acceso a ’dma  ->  tx_running’ está serializado."}],"id":"CVE-2026-43061","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:37.230216Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.210","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a72403b985aea6b4aac3171830492f9a387f9e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5f6b17562f03fc65c7d3474ef8f1959b19d1ca41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79a19bd936bb35f56ef0ccab1b3b59ebce8c762d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8190f9ab6ad90cb97652adbebd238b874a4ef70d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a424a34b8faddf97b5af41689087e7a230f79ba7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5ad887339503103d0fbe9827b16ad287597c275"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2719a0a9c3439abf67843a5504b7afccd9ded93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f76d91271bcacbd759a2e4ee3ea61faa6a727ccf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43062.json b/data/2026/CVE-2026-43062.json
index 269e5a825f..3ab9933d9f 100644
--- a/data/2026/CVE-2026-43062.json
+++ b/data/2026/CVE-2026-43062.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"21d3ba696918d6373233aac0b9d51fcabdedddc0","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"3b94e62caa1dc1198d0d55d97bd710da1dee15d7","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"111f74547eee8cfedfb854284e80f35c8a491186","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"dd3b221e21079ade8263fbb7176f3d55ad75d3b6","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"d90150c72d2e6a8a3079e88755dafcfbe91c746d","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"5a1ea296f8589ce8f1e3141b2b123b34ad010e19","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"f110b8f58b254bf997cec1bd60701b7798e9bb82","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"15145675690cab2de1056e7ed68e59cbd0452529","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0B1A046E-0C62-426C-8D6D-9BCC6EB56D6E","versionEndExcluding":"5.10.253","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()\n\nl2cap_ecred_reconf_rsp() casts the incoming data to struct\nl2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with\nresult at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes\nwith result at offset 0).\n\nThis causes two problems:\n\n - The sizeof(*rsp) length check requires 8 bytes instead of the\n   correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected\n   with -EPROTO.\n\n - rsp->result reads from offset 6 instead of offset 0, returning\n   wrong data when the packet is large enough to pass the check.\n\nFix by using the correct type.  Also pass the already byte-swapped\nresult variable to BT_DBG instead of the raw __le16 field."}],"id":"CVE-2026-43062","lastModified":"2026-10-19T20:18:03.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:12.423204Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/111f74547eee8cfedfb854284e80f35c8a491186"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15145675690cab2de1056e7ed68e59cbd0452529"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21d3ba696918d6373233aac0b9d51fcabdedddc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b94e62caa1dc1198d0d55d97bd710da1dee15d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a1ea296f8589ce8f1e3141b2b123b34ad010e19"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d90150c72d2e6a8a3079e88755dafcfbe91c746d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd3b221e21079ade8263fbb7176f3d55ad75d3b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f110b8f58b254bf997cec1bd60701b7798e9bb82"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-843"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"21d3ba696918d6373233aac0b9d51fcabdedddc0","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"3b94e62caa1dc1198d0d55d97bd710da1dee15d7","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"111f74547eee8cfedfb854284e80f35c8a491186","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"dd3b221e21079ade8263fbb7176f3d55ad75d3b6","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"d90150c72d2e6a8a3079e88755dafcfbe91c746d","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"5a1ea296f8589ce8f1e3141b2b123b34ad010e19","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"f110b8f58b254bf997cec1bd60701b7798e9bb82","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"},{"lessThan":"15145675690cab2de1056e7ed68e59cbd0452529","status":"affected","version":"15f02b91056253e8cdc592888f431da0731337b8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0B1A046E-0C62-426C-8D6D-9BCC6EB56D6E","versionEndExcluding":"5.10.253","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()\n\nl2cap_ecred_reconf_rsp() casts the incoming data to struct\nl2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with\nresult at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes\nwith result at offset 0).\n\nThis causes two problems:\n\n - The sizeof(*rsp) length check requires 8 bytes instead of the\n   correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected\n   with -EPROTO.\n\n - rsp->result reads from offset 6 instead of offset 0, returning\n   wrong data when the packet is large enough to pass the check.\n\nFix by using the correct type.  Also pass the already byte-swapped\nresult variable to BT_DBG instead of the raw __le16 field."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Corrección de confusión de tipos en l2cap_ecred_reconf_rsp()\n\nl2cap_ecred_reconf_rsp() convierte los datos entrantes a struct l2cap_ecred_conn_rsp (la respuesta ECRED de conexión, 8 bytes con el resultado en el desplazamiento 6) en lugar de struct l2cap_ecred_reconf_rsp (2 bytes con el resultado en el desplazamiento 0).\n\nEsto causa dos problemas:\n\n - La comprobación de longitud de sizeof(rsp) requiere 8 bytes en lugar de los 2 correctos, por lo que los paquetes L2CAP_ECRED_RECONF_RSP válidos son rechazados con -EPROTO.\n\n - rsp  ->  result lee desde el desplazamiento 6 en lugar del desplazamiento 0, devolviendo datos incorrectos cuando el paquete es lo suficientemente grande como para pasar la comprobación.\n\nCorrección mediante el uso del tipo correcto. También se pasa la variable de resultado ya con los bytes intercambiados a BT_DBG en lugar del campo __le16 en bruto."}],"id":"CVE-2026-43062","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43062","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:12.423204Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/111f74547eee8cfedfb854284e80f35c8a491186"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15145675690cab2de1056e7ed68e59cbd0452529"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21d3ba696918d6373233aac0b9d51fcabdedddc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b94e62caa1dc1198d0d55d97bd710da1dee15d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a1ea296f8589ce8f1e3141b2b123b34ad010e19"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d90150c72d2e6a8a3079e88755dafcfbe91c746d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd3b221e21079ade8263fbb7176f3d55ad75d3b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f110b8f58b254bf997cec1bd60701b7798e9bb82"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-843"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43063.json b/data/2026/CVE-2026-43063.json
index 7c45cfd13b..c76a07add7 100644
--- a/data/2026/CVE-2026-43063.json
+++ b/data/2026/CVE-2026-43063.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/xfs_attr_item.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b5c5a50c2f513d4a13a6763564a07b470e69cc5a","status":"affected","version":"ae673f534a30976ce5e709c4535a59c12b786ef3","versionType":"git"},{"lessThan":"a1a5df1038f0b3c560d204270373621a4e622808","status":"affected","version":"ae673f534a30976ce5e709c4535a59c12b786ef3","versionType":"git"},{"lessThan":"40082d08b638485cbaa543dc8087a3d1844d6f08","status":"affected","version":"ae673f534a30976ce5e709c4535a59c12b786ef3","versionType":"git"},{"lessThan":"70685c291ef82269180758130394ecdc4496b52c","status":"affected","version":"ae673f534a30976ce5e709c4535a59c12b786ef3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/xfs_attr_item.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F453D4BE-C3D9-4385-BD03-DDA5B0033CA8","versionEndExcluding":"6.12.80","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't irele after failing to iget in xfs_attri_recover_work\n\nxlog_recovery_iget* never set @ip to a valid pointer if they return\nan error, so this irele will walk off a dangling pointer.  Fix that."}],"id":"CVE-2026-43063","lastModified":"2026-10-19T20:18:03.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43063","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:14.697660Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.467","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40082d08b638485cbaa543dc8087a3d1844d6f08"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70685c291ef82269180758130394ecdc4496b52c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1a5df1038f0b3c560d204270373621a4e622808"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5c5a50c2f513d4a13a6763564a07b470e69cc5a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/xfs_attr_item.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b5c5a50c2f513d4a13a6763564a07b470e69cc5a","status":"affected","version":"ae673f534a30976ce5e709c4535a59c12b786ef3","versionType":"git"},{"lessThan":"a1a5df1038f0b3c560d204270373621a4e622808","status":"affected","version":"ae673f534a30976ce5e709c4535a59c12b786ef3","versionType":"git"},{"lessThan":"40082d08b638485cbaa543dc8087a3d1844d6f08","status":"affected","version":"ae673f534a30976ce5e709c4535a59c12b786ef3","versionType":"git"},{"lessThan":"70685c291ef82269180758130394ecdc4496b52c","status":"affected","version":"ae673f534a30976ce5e709c4535a59c12b786ef3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/xfs_attr_item.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F453D4BE-C3D9-4385-BD03-DDA5B0033CA8","versionEndExcluding":"6.12.80","versionStartIncluding":"6.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't irele after failing to iget in xfs_attri_recover_work\n\nxlog_recovery_iget* never set @ip to a valid pointer if they return\nan error, so this irele will walk off a dangling pointer.  Fix that."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfs: no irele después de fallar al iget en xfs_attri_recover_work\n\nxlog_recovery_iget nunca establece @ip a un puntero válido si devuelven un error, por lo que este irele accederá a un puntero colgante. Corregir eso."}],"id":"CVE-2026-43063","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43063","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:14.697660Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.467","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40082d08b638485cbaa543dc8087a3d1844d6f08"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70685c291ef82269180758130394ecdc4496b52c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1a5df1038f0b3c560d204270373621a4e622808"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5c5a50c2f513d4a13a6763564a07b470e69cc5a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43064.json b/data/2026/CVE-2026-43064.json
index 21fa4105ff..c79185d561 100644
--- a/data/2026/CVE-2026-43064.json
+++ b/data/2026/CVE-2026-43064.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70ae35be58d476e2fd9f7a941a5e03b2f5fadb8d","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"b22fd53b2ceb35445475f0edab13a908c5fb8433","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"d02c24af126dee45247dc7890409c86d1831859d","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"958e96533ddbd1edd127feb7624a7eed0cc379dc","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"fc34f199eb576b3a73089452fdf0056cc9a9301d","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"3d33de353b1ff9023d5ec73b9becf80ea87af695","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"status":"affected","version":"3f0e87eb9680975184e98aed0e8866b4442a31f6","versionType":"git"},{"status":"affected","version":"a13e4cf29da68630a116c1309072a265ade9566d","versionType":"git"},{"lessThan":"5.12","status":"affected","version":"5.11.22","versionType":"semver"},{"lessThan":"5.13","status":"affected","version":"5.12.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4BA7BC58-B6BD-469F-B348-D71C30EF4397","versionEndExcluding":"5.12","versionStartIncluding":"5.11.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2CA34CAF-7251-4EB2-8208-AC54EF7AD9C9","versionEndExcluding":"5.13","versionStartIncluding":"5.12.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04D24E88-753A-4536-B478-6EEE3223E44B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix not releasing workqueue on .release()\n\nThe workqueue associated with an DSA/IAA device is not released when\nthe object is freed."}],"id":"CVE-2026-43064","lastModified":"2026-11-06T16:18:20.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:42.454015Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.567","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d33de353b1ff9023d5ec73b9becf80ea87af695"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/70ae35be58d476e2fd9f7a941a5e03b2f5fadb8d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/958e96533ddbd1edd127feb7624a7eed0cc379dc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b22fd53b2ceb35445475f0edab13a908c5fb8433"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d02c24af126dee45247dc7890409c86d1831859d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fc34f199eb576b3a73089452fdf0056cc9a9301d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70ae35be58d476e2fd9f7a941a5e03b2f5fadb8d","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"b22fd53b2ceb35445475f0edab13a908c5fb8433","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"d02c24af126dee45247dc7890409c86d1831859d","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"958e96533ddbd1edd127feb7624a7eed0cc379dc","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"fc34f199eb576b3a73089452fdf0056cc9a9301d","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"lessThan":"3d33de353b1ff9023d5ec73b9becf80ea87af695","status":"affected","version":"47c16ac27d4cb664cee53ee0b9b7e2f907923fb3","versionType":"git"},{"status":"affected","version":"3f0e87eb9680975184e98aed0e8866b4442a31f6","versionType":"git"},{"status":"affected","version":"a13e4cf29da68630a116c1309072a265ade9566d","versionType":"git"},{"lessThan":"5.12","status":"affected","version":"5.11.22","versionType":"semver"},{"lessThan":"5.13","status":"affected","version":"5.12.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4BA7BC58-B6BD-469F-B348-D71C30EF4397","versionEndExcluding":"5.12","versionStartIncluding":"5.11.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2CA34CAF-7251-4EB2-8208-AC54EF7AD9C9","versionEndExcluding":"5.13","versionStartIncluding":"5.12.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04D24E88-753A-4536-B478-6EEE3223E44B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix not releasing workqueue on .release()\n\nThe workqueue associated with an DSA/IAA device is not released when\nthe object is freed."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: idxd: Corrección de la no liberación de la workqueue en .release()\n\nLa workqueue asociada con un dispositivo DSA/IAA no se libera cuando el objeto es liberado."}],"id":"CVE-2026-43064","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:42.454015Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.567","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d33de353b1ff9023d5ec73b9becf80ea87af695"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/70ae35be58d476e2fd9f7a941a5e03b2f5fadb8d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/958e96533ddbd1edd127feb7624a7eed0cc379dc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b22fd53b2ceb35445475f0edab13a908c5fb8433"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d02c24af126dee45247dc7890409c86d1831859d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fc34f199eb576b3a73089452fdf0056cc9a9301d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43065.json b/data/2026/CVE-2026-43065.json
index 877102fed2..9c3801513b 100644
--- a/data/2026/CVE-2026-43065.json
+++ b/data/2026/CVE-2026-43065.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/mballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e96c2354b170aaa53300c8e8fd59e41b133160f7","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"c360e9d0def4f4ae03254a67c683103908555b75","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"1c82f863f090ab899085bdfade073313384b514b","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"9ee29d20aab228adfb02ca93f87fb53c56c2f3af","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/mballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85C0DA29-FD98-4182-B0A1-624E28976709","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: always drain queued discard work in ext4_mb_release()\n\nWhile reviewing recent ext4 patch[1], Sashiko raised the following\nconcern[2]:\n\n> If the filesystem is initially mounted with the discard option,\n> deleting files will populate sbi->s_discard_list and queue\n> s_discard_work. If it is then remounted with nodiscard, the\n> EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is\n> neither cancelled nor flushed.\n\n[1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/\n[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev\n\nThe concern was valid, but it had nothing to do with the patch[1].\nOne of the problems with Sashiko in its current (early) form is that\nit will detect pre-existing issues and report it as a problem with the\npatch that it is reviewing.\n\nIn practice, it would be hard to hit deliberately (unless you are a\nmalicious syzkaller fuzzer), since it would involve mounting the file\nsystem with -o discard, and then deleting a large number of files,\nremounting the file system with -o nodiscard, and then immediately\nunmounting the file system before the queued discard work has a change\nto drain on its own.\n\nFix it because it's a real bug, and to avoid Sashiko from raising this\nconcern when analyzing future patches to mballoc.c."}],"id":"CVE-2026-43065","lastModified":"2026-11-06T16:18:20.567","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43065","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:46.955616Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.683","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c82f863f090ab899085bdfade073313384b514b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ee29d20aab228adfb02ca93f87fb53c56c2f3af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c360e9d0def4f4ae03254a67c683103908555b75"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e96c2354b170aaa53300c8e8fd59e41b133160f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/mballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e96c2354b170aaa53300c8e8fd59e41b133160f7","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"c360e9d0def4f4ae03254a67c683103908555b75","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"1c82f863f090ab899085bdfade073313384b514b","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"},{"lessThan":"9ee29d20aab228adfb02ca93f87fb53c56c2f3af","status":"affected","version":"55cdd0af2bc5ffc92a2deb745627755aecd5db33","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/mballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85C0DA29-FD98-4182-B0A1-624E28976709","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: always drain queued discard work in ext4_mb_release()\n\nWhile reviewing recent ext4 patch[1], Sashiko raised the following\nconcern[2]:\n\n> If the filesystem is initially mounted with the discard option,\n> deleting files will populate sbi->s_discard_list and queue\n> s_discard_work. If it is then remounted with nodiscard, the\n> EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is\n> neither cancelled nor flushed.\n\n[1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/\n[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev\n\nThe concern was valid, but it had nothing to do with the patch[1].\nOne of the problems with Sashiko in its current (early) form is that\nit will detect pre-existing issues and report it as a problem with the\npatch that it is reviewing.\n\nIn practice, it would be hard to hit deliberately (unless you are a\nmalicious syzkaller fuzzer), since it would involve mounting the file\nsystem with -o discard, and then deleting a large number of files,\nremounting the file system with -o nodiscard, and then immediately\nunmounting the file system before the queued discard work has a change\nto drain on its own.\n\nFix it because it's a real bug, and to avoid Sashiko from raising this\nconcern when analyzing future patches to mballoc.c."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: siempre vaciar el trabajo de descarte en cola en ext4_mb_release()\n\nMientras revisaba un parche reciente de ext4[1], Sashiko planteó la siguiente preocupación[2]:\n\n’Si el sistema de archivos se monta inicialmente con la opción discard, eliminar archivos poblará sbi  ->  s_discard_list y pondrá en cola s_discard_work. Si luego se vuelve a montar con nodiscard, la bandera EXT4_MOUNT_DISCARD se borra, pero el s_discard_work pendiente no se cancela ni se vacía.’\n\n[1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/\n[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev\n\nLa preocupación era válida, pero no tenía nada que ver con el parche[1]. Uno de los problemas con Sashiko en su forma actual (temprana) es que detectará problemas preexistentes y los reportará como un problema con el parche que está revisando.\n\nEn la práctica, sería difícil de activar deliberadamente (a menos que seas un fuzzer syzkaller malicioso), ya que implicaría montar el sistema de archivos con -o discard, y luego eliminar un gran número de archivos, volver a montar el sistema de archivos con -o nodiscard, y luego desmontar inmediatamente el sistema de archivos antes de que el trabajo de descarte en cola tenga la oportunidad de vaciarse por sí solo.\n\nSe corrige porque es un error real, y para evitar que Sashiko plantee esta preocupación al analizar futuros parches para mballoc.c."}],"id":"CVE-2026-43065","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43065","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:46.955616Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:15.683","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c82f863f090ab899085bdfade073313384b514b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ee29d20aab228adfb02ca93f87fb53c56c2f3af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c360e9d0def4f4ae03254a67c683103908555b75"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e96c2354b170aaa53300c8e8fd59e41b133160f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43066.json b/data/2026/CVE-2026-43066.json
index fb93fe553d..c18abad641 100644
--- a/data/2026/CVE-2026-43066.json
+++ b/data/2026/CVE-2026-43066.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/fast_commit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0892f12cd49fde5d5db68137923db107f894f3a3","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"5a63033696e60b5d70816f1d119645ac5b0b0a03","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"19782b4c793b49a6aa4abbb307ddff3610009d21","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"f7817ad399d604e8639005d87d148b5ec626ad26","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"c426231e3d51916e83b6d1ab7ed8a65e83bca5b4","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"ec0a7500d8eace5b4f305fa0c594dd148f0e8d29","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/fast_commit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3A9919A7-65FC-46B6-B195-F4325BB94AFD","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix iloc.bh leak in ext4_fc_replay_inode() error paths\n\nDuring code review, Joseph found that ext4_fc_replay_inode() calls\next4_get_fc_inode_loc() to get the inode location, which holds a\nreference to iloc.bh that must be released via brelse().\n\nHowever, several error paths jump to the 'out' label without\nreleasing iloc.bh:\n\n - ext4_handle_dirty_metadata() failure\n - sync_dirty_buffer() failure\n - ext4_mark_inode_used() failure\n - ext4_iget() failure\n\nFix this by introducing an 'out_brelse' label placed just before\nthe existing 'out' label to ensure iloc.bh is always released.\n\nAdditionally, make ext4_fc_replay_inode() propagate errors\nproperly instead of always returning 0."}],"id":"CVE-2026-43066","lastModified":"2026-06-17T10:48:52.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-05T16:16:15.810","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0892f12cd49fde5d5db68137923db107f894f3a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19782b4c793b49a6aa4abbb307ddff3610009d21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a63033696e60b5d70816f1d119645ac5b0b0a03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c426231e3d51916e83b6d1ab7ed8a65e83bca5b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec0a7500d8eace5b4f305fa0c594dd148f0e8d29"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7817ad399d604e8639005d87d148b5ec626ad26"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/fast_commit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0892f12cd49fde5d5db68137923db107f894f3a3","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"5a63033696e60b5d70816f1d119645ac5b0b0a03","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"19782b4c793b49a6aa4abbb307ddff3610009d21","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"f7817ad399d604e8639005d87d148b5ec626ad26","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"c426231e3d51916e83b6d1ab7ed8a65e83bca5b4","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"ec0a7500d8eace5b4f305fa0c594dd148f0e8d29","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/fast_commit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3A9919A7-65FC-46B6-B195-F4325BB94AFD","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix iloc.bh leak in ext4_fc_replay_inode() error paths\n\nDuring code review, Joseph found that ext4_fc_replay_inode() calls\next4_get_fc_inode_loc() to get the inode location, which holds a\nreference to iloc.bh that must be released via brelse().\n\nHowever, several error paths jump to the 'out' label without\nreleasing iloc.bh:\n\n - ext4_handle_dirty_metadata() failure\n - sync_dirty_buffer() failure\n - ext4_mark_inode_used() failure\n - ext4_iget() failure\n\nFix this by introducing an 'out_brelse' label placed just before\nthe existing 'out' label to ensure iloc.bh is always released.\n\nAdditionally, make ext4_fc_replay_inode() propagate errors\nproperly instead of always returning 0."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: corregir la fuga de iloc.bh en las rutas de error de ext4_fc_replay_inode()\n\nDurante la revisión de código, Joseph descubrió que ext4_fc_replay_inode() llama a ext4_get_fc_inode_loc() para obtener la ubicación del inodo, la cual mantiene una referencia a iloc.bh que debe ser liberada a través de brelse().\n\nSin embargo, varias rutas de error saltan a la etiqueta ’out’ sin liberar iloc.bh:\n\n - fallo de ext4_handle_dirty_metadata()\n - fallo de sync_dirty_buffer()\n - fallo de ext4_mark_inode_used()\n - fallo de ext4_iget()\n\nEsto se corrige introduciendo una etiqueta ’out_brelse’ colocada justo antes de la etiqueta ’out’ existente para asegurar que iloc.bh siempre sea liberada.\n\nAdemás, hacer que ext4_fc_replay_inode() propague los errores correctamente en lugar de siempre devolver 0."}],"id":"CVE-2026-43066","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-05T16:16:15.810","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0892f12cd49fde5d5db68137923db107f894f3a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19782b4c793b49a6aa4abbb307ddff3610009d21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a63033696e60b5d70816f1d119645ac5b0b0a03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c426231e3d51916e83b6d1ab7ed8a65e83bca5b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec0a7500d8eace5b4f305fa0c594dd148f0e8d29"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7817ad399d604e8639005d87d148b5ec626ad26"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43068.json b/data/2026/CVE-2026-43068.json
index 3da365fe4f..53c0a4f2b6 100644
--- a/data/2026/CVE-2026-43068.json
+++ b/data/2026/CVE-2026-43068.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/mballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fea6b2e250ff48f10d166011b57a8516ae5438c9","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"0b84571c886719823d537f05f4f07cad6357c4b7","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"ffc0a282462d45fee5957621be5afa29752f3b6d","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"2d31a5073f86a177edf44015e0dedb0c47cfd6d8","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"9370207b36d26e45a8c8ef0500706d37036edd6b","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"1895f7904be71c48f1e6f338b28f24dabd6b8aeb","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"1c0d7c4cde38a887c6d74e0c89ddb25226943c78","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"46066e3a06647c5b186cc6334409722622d05c44","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/mballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.12"},{"lessThan":"3.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0ECA9FA3-7D5A-47DF-96CD-50ED0F72C020","versionEndExcluding":"5.10.253","versionStartIncluding":"3.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()\n\nThere's issue as follows:\n...\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): error count since last fsck: 1\nEXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760\nEXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760\n...\n\nAccording to the log analysis, blocks are always requested from the\ncorrupted block group. This may happen as follows:\next4_mb_find_by_goal\n  ext4_mb_load_buddy\n   ext4_mb_load_buddy_gfp\n     ext4_mb_init_cache\n      ext4_read_block_bitmap_nowait\n      ext4_wait_block_bitmap\n       ext4_validate_block_bitmap\n        if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))\n         return -EFSCORRUPTED; // There's no logs.\n if (err)\n  return err;  // Will return error\next4_lock_group(ac->ac_sb, group);\n  if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable\n   goto out;\n\nAfter commit 9008a58e5dce (\"ext4: make the bitmap read routines return\nreal error codes\") merged, Commit 163a203ddb36 (\"ext4: mark block group\nas corrupt on block bitmap error\") is no real solution for allocating\nblocks from corrupted block groups. This is because if\n'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then\n'ext4_mb_load_buddy()' may return an error. This means that the block\nallocation will fail.\nTherefore, check block group if corrupted when ext4_mb_load_buddy()\nreturns error."}],"id":"CVE-2026-43068","lastModified":"2026-11-06T16:18:20.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43068","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:50.996152Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:16.053","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b84571c886719823d537f05f4f07cad6357c4b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1895f7904be71c48f1e6f338b28f24dabd6b8aeb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c0d7c4cde38a887c6d74e0c89ddb25226943c78"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d31a5073f86a177edf44015e0dedb0c47cfd6d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46066e3a06647c5b186cc6334409722622d05c44"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9370207b36d26e45a8c8ef0500706d37036edd6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fea6b2e250ff48f10d166011b57a8516ae5438c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ffc0a282462d45fee5957621be5afa29752f3b6d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/mballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fea6b2e250ff48f10d166011b57a8516ae5438c9","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"0b84571c886719823d537f05f4f07cad6357c4b7","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"ffc0a282462d45fee5957621be5afa29752f3b6d","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"2d31a5073f86a177edf44015e0dedb0c47cfd6d8","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"9370207b36d26e45a8c8ef0500706d37036edd6b","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"1895f7904be71c48f1e6f338b28f24dabd6b8aeb","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"1c0d7c4cde38a887c6d74e0c89ddb25226943c78","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"},{"lessThan":"46066e3a06647c5b186cc6334409722622d05c44","status":"affected","version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/mballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.12"},{"lessThan":"3.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0ECA9FA3-7D5A-47DF-96CD-50ED0F72C020","versionEndExcluding":"5.10.253","versionStartIncluding":"3.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()\n\nThere's issue as follows:\n...\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117\nEXT4-fs (mmcblk0p1): This should not happen!! Data will be lost\n\nEXT4-fs (mmcblk0p1): error count since last fsck: 1\nEXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760\nEXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760\n...\n\nAccording to the log analysis, blocks are always requested from the\ncorrupted block group. This may happen as follows:\next4_mb_find_by_goal\n  ext4_mb_load_buddy\n   ext4_mb_load_buddy_gfp\n     ext4_mb_init_cache\n      ext4_read_block_bitmap_nowait\n      ext4_wait_block_bitmap\n       ext4_validate_block_bitmap\n        if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))\n         return -EFSCORRUPTED; // There's no logs.\n if (err)\n  return err;  // Will return error\next4_lock_group(ac->ac_sb, group);\n  if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable\n   goto out;\n\nAfter commit 9008a58e5dce (\"ext4: make the bitmap read routines return\nreal error codes\") merged, Commit 163a203ddb36 (\"ext4: mark block group\nas corrupt on block bitmap error\") is no real solution for allocating\nblocks from corrupted block groups. This is because if\n'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then\n'ext4_mb_load_buddy()' may return an error. This means that the block\nallocation will fail.\nTherefore, check block group if corrupted when ext4_mb_load_buddy()\nreturns error."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: evitar asignar bloque de grupo corrupto en ext4_mb_find_by_goal()\n\nHay un problema como sigue:\n...\nEXT4-fs (mmcblk0p1): Falló la asignación de bloque retrasada para el inodo 206 en el desplazamiento lógico 0 con un máximo de bloques 1 con error 117\nEXT4-fs (mmcblk0p1): ¡¡Esto no debería ocurrir!! Se perderán datos\n\nEXT4-fs (mmcblk0p1): Falló la asignación de bloque retrasada para el inodo 206 en el desplazamiento lógico 0 con un máximo de bloques 1 con error 117\nEXT4-fs (mmcblk0p1): ¡¡Esto no debería ocurrir!! Se perderán datos\n\nEXT4-fs (mmcblk0p1): Falló la asignación de bloque retrasada para el inodo 206 en el desplazamiento lógico 0 con un máximo de bloques 1 con error 117\nEXT4-fs (mmcblk0p1): ¡¡Esto no debería ocurrir!! Se perderán datos\n\nEXT4-fs (mmcblk0p1): Falló la asignación de bloque retrasada para el inodo 206 en el desplazamiento lógico 0 con un máximo de bloques 1 con error 117\nEXT4-fs (mmcblk0p1): ¡¡Esto no debería ocurrir!! Se perderán datos\n\nEXT4-fs (mmcblk0p1): Falló la asignación de bloque retrasada para el inodo 2243 en el desplazamiento lógico 0 con un máximo de bloques 1 con error 117\nEXT4-fs (mmcblk0p1): ¡¡Esto no debería ocurrir!! Se perderán datos\n\nEXT4-fs (mmcblk0p1): Falló la asignación de bloque retrasada para el inodo 2239 en el desplazamiento lógico 0 con un máximo de bloques 1 con error 117\nEXT4-fs (mmcblk0p1): ¡¡Esto no debería ocurrir!! Se perderán datos\n\nEXT4-fs (mmcblk0p1): recuento de errores desde el último fsck: 1\nEXT4-fs (mmcblk0p1): error inicial en el momento 1765597433: ext4_mb_generate_buddy:760\nEXT4-fs (mmcblk0p1): último error en el momento 1765597433: ext4_mb_generate_buddy:760\n...\n\nSegún el análisis del registro, los bloques siempre se solicitan del grupo de bloques corrupto. Esto puede ocurrir de la siguiente manera:\next4_mb_find_by_goal\n  ext4_mb_load_buddy\n   ext4_mb_load_buddy_gfp\n     ext4_mb_init_cache\n      ext4_read_block_bitmap_nowait\n      ext4_wait_block_bitmap\n       ext4_validate_block_bitmap\n        si (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))\n         retornar -EFSCORRUPTED; // No hay registros.\n si (err)\n  retornar err; // Retornará error\next4_lock_group(ac  ->  ac_sb, group);\n  si (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b  ->  bd_info))) // Inalcanzable\n   ir a out;\n\nDespués de que el commit 9008a58e5dce (’ext4: hacer que las rutinas de lectura de bitmap devuelvan códigos de error reales’) se fusionara, el Commit 163a203ddb36 (’ext4: marcar el grupo de bloques como corrupto en caso de error de bitmap de bloque’) no es una solución real para asignar bloques de grupos de bloques corruptos. Esto se debe a que si ’EXT4_MB_GRP_BBITMAP_CORRUPT(e4b  ->  bd_info)’ es verdadero, entonces ’ext4_mb_load_buddy()’ puede devolver un error. Esto significa que la asignación de bloques fallará.\nPor lo tanto, verificar el grupo de bloques si está corrupto cuando ext4_mb_load_buddy() devuelve un error."}],"id":"CVE-2026-43068","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43068","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:50.996152Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:16.053","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b84571c886719823d537f05f4f07cad6357c4b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1895f7904be71c48f1e6f338b28f24dabd6b8aeb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c0d7c4cde38a887c6d74e0c89ddb25226943c78"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d31a5073f86a177edf44015e0dedb0c47cfd6d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46066e3a06647c5b186cc6334409722622d05c44"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9370207b36d26e45a8c8ef0500706d37036edd6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fea6b2e250ff48f10d166011b57a8516ae5438c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ffc0a282462d45fee5957621be5afa29752f3b6d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43069.json b/data/2026/CVE-2026-43069.json
index e40cd959d0..9823059236 100644
--- a/data/2026/CVE-2026-43069.json
+++ b/data/2026/CVE-2026-43069.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/bluetooth/hci_ll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"95e8601af227b2b4390eecf8db6abdb9f6a91f17","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"e6d95488c8c964d1df0d3e1db44c958706311e86","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"b2dfbf1b5ff192cefd49574b951a4af9ddd32213","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"28904375d54b436a757641fb0331537778c0de5a","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"5213ef54528dd1ac79b846e30d8f72ce092794aa","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"a7803df606a7d22e896b030f619e1d9d20ae0c6b","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"31148a7be723aa9f2e8fbd62424825ab8d577973","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/bluetooth/hci_ll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7307BD3-C434-4557-91D2-ADE06A1D3C6F","versionEndExcluding":"5.10.253","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_ll: Fix firmware leak on error path\n\nSmatch reports:\n\ndrivers/bluetooth/hci_ll.c:587 download_firmware() warn:\n'fw' from request_firmware() not released on lines: 544.\n\nIn download_firmware(), if request_firmware() succeeds but the returned\nfirmware content is invalid (no data or zero size), the function returns\nwithout releasing the firmware, resulting in a resource leak.\n\nFix this by calling release_firmware() before returning when\nrequest_firmware() succeeded but the firmware content is invalid."}],"id":"CVE-2026-43069","lastModified":"2026-06-17T10:48:52.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-05T16:16:16.197","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28904375d54b436a757641fb0331537778c0de5a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/31148a7be723aa9f2e8fbd62424825ab8d577973"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5213ef54528dd1ac79b846e30d8f72ce092794aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95e8601af227b2b4390eecf8db6abdb9f6a91f17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7803df606a7d22e896b030f619e1d9d20ae0c6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b2dfbf1b5ff192cefd49574b951a4af9ddd32213"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6d95488c8c964d1df0d3e1db44c958706311e86"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/bluetooth/hci_ll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"95e8601af227b2b4390eecf8db6abdb9f6a91f17","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"e6d95488c8c964d1df0d3e1db44c958706311e86","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"b2dfbf1b5ff192cefd49574b951a4af9ddd32213","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"28904375d54b436a757641fb0331537778c0de5a","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"5213ef54528dd1ac79b846e30d8f72ce092794aa","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"a7803df606a7d22e896b030f619e1d9d20ae0c6b","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"},{"lessThan":"31148a7be723aa9f2e8fbd62424825ab8d577973","status":"affected","version":"371805522f870986144fcd88727a47858e364a2c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/bluetooth/hci_ll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7307BD3-C434-4557-91D2-ADE06A1D3C6F","versionEndExcluding":"5.10.253","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_ll: Fix firmware leak on error path\n\nSmatch reports:\n\ndrivers/bluetooth/hci_ll.c:587 download_firmware() warn:\n'fw' from request_firmware() not released on lines: 544.\n\nIn download_firmware(), if request_firmware() succeeds but the returned\nfirmware content is invalid (no data or zero size), the function returns\nwithout releasing the firmware, resulting in a resource leak.\n\nFix this by calling release_firmware() before returning when\nrequest_firmware() succeeded but the firmware content is invalid."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: hci_ll: Corregir fuga de firmware en la ruta de error\n\nSmatch informa:\n\ndrivers/bluetooth/hci_ll.c:587 download_firmware() advierte:\n’fw’ de request_firmware() no liberado en las líneas: 544.\n\nEn download_firmware(), si request_firmware() tiene éxito pero el contenido del firmware devuelto es inválido (sin datos o tamaño cero), la función retorna sin liberar el firmware, lo que resulta en una fuga de recursos.\n\nSolucionar esto llamando a release_firmware() antes de retornar cuando request_firmware() tuvo éxito pero el contenido del firmware es inválido."}],"id":"CVE-2026-43069","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-05T16:16:16.197","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28904375d54b436a757641fb0331537778c0de5a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/31148a7be723aa9f2e8fbd62424825ab8d577973"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5213ef54528dd1ac79b846e30d8f72ce092794aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95e8601af227b2b4390eecf8db6abdb9f6a91f17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7803df606a7d22e896b030f619e1d9d20ae0c6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b2dfbf1b5ff192cefd49574b951a4af9ddd32213"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6d95488c8c964d1df0d3e1db44c958706311e86"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43070.json b/data/2026/CVE-2026-43070.json
index 9074d847ab..91cd7834c1 100644
--- a/data/2026/CVE-2026-43070.json
+++ b/data/2026/CVE-2026-43070.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a17443af874229408ce6b78e2c8a2b5adeb4b7d8","status":"affected","version":"4c03342e5ac532fb34d13a7b51dd7261dfc48963","versionType":"git"},{"lessThan":"0d15c3611a2cc5d08993545d4032055ae10ae2c1","status":"affected","version":"d00ce96623a69a100ad79675d0e85fda3c50d89b","versionType":"git"},{"lessThan":"a3125bc01884431d30d731461634c8295b6f0529","status":"affected","version":"9d21199842247ab05c675fb9b6c6ca393a5c0024","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.21","status":"affected","version":"6.18.17","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.7","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3EF23CE5-8E2E-47D1-9B2C-449AA5BB1870","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0F154E5F-DF7A-4EB9-BAFA-13EC093D679A","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register ID for BPF_END value tracking\n\nWhen a register undergoes a BPF_END (byte swap) operation, its scalar\nvalue is mutated in-place. If this register previously shared a scalar ID\nwith another register (e.g., after an `r1 = r0` assignment), this tie must\nbe broken.\n\nCurrently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END.\nConsequently, if a conditional jump checks the swapped register, the\nverifier incorrectly propagates the learned bounds to the linked register,\nleading to false confidence in the linked register's value and potentially\nallowing out-of-bounds memory accesses.\n\nFix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case\nto break the scalar tie, similar to how BPF_NEG handles it via\n`__mark_reg_known`."}],"id":"CVE-2026-43070","lastModified":"2026-06-17T10:48:52.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-05T16:16:16.320","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d15c3611a2cc5d08993545d4032055ae10ae2c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a17443af874229408ce6b78e2c8a2b5adeb4b7d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3125bc01884431d30d731461634c8295b6f0529"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a17443af874229408ce6b78e2c8a2b5adeb4b7d8","status":"affected","version":"4c03342e5ac532fb34d13a7b51dd7261dfc48963","versionType":"git"},{"lessThan":"0d15c3611a2cc5d08993545d4032055ae10ae2c1","status":"affected","version":"d00ce96623a69a100ad79675d0e85fda3c50d89b","versionType":"git"},{"lessThan":"a3125bc01884431d30d731461634c8295b6f0529","status":"affected","version":"9d21199842247ab05c675fb9b6c6ca393a5c0024","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.21","status":"affected","version":"6.18.17","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.7","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3EF23CE5-8E2E-47D1-9B2C-449AA5BB1870","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0F154E5F-DF7A-4EB9-BAFA-13EC093D679A","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reset register ID for BPF_END value tracking\n\nWhen a register undergoes a BPF_END (byte swap) operation, its scalar\nvalue is mutated in-place. If this register previously shared a scalar ID\nwith another register (e.g., after an `r1 = r0` assignment), this tie must\nbe broken.\n\nCurrently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END.\nConsequently, if a conditional jump checks the swapped register, the\nverifier incorrectly propagates the learned bounds to the linked register,\nleading to false confidence in the linked register's value and potentially\nallowing out-of-bounds memory accesses.\n\nFix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case\nto break the scalar tie, similar to how BPF_NEG handles it via\n`__mark_reg_known`."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Restablecer ID de registro para el seguimiento de valores BPF_END\n\nCuando un registro se somete a una operación BPF_END (intercambio de bytes), su valor escalar se muta in situ. Si este registro previamente compartía un ID escalar con otro registro (por ejemplo, después de una asignación ’r1 = r0’), este vínculo debe romperse.\n\nActualmente, el verificador omite restablecer ’dst_reg  ->  id’ a 0 para BPF_END. En consecuencia, si un salto condicional verifica el registro intercambiado, el verificador propaga incorrectamente los límites aprendidos al registro vinculado, lo que lleva a una falsa confianza en el valor del registro vinculado y potencialmente permitiendo accesos a memoria fuera de límites.\n\nSolucionar esto restableciendo explícitamente ’dst_reg  ->  id’ a 0 en el caso BPF_END para romper el vínculo escalar, similar a cómo BPF_NEG lo maneja a través de ’__mark_reg_known’."}],"id":"CVE-2026-43070","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-05T16:16:16.320","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d15c3611a2cc5d08993545d4032055ae10ae2c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a17443af874229408ce6b78e2c8a2b5adeb4b7d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3125bc01884431d30d731461634c8295b6f0529"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43071.json b/data/2026/CVE-2026-43071.json
index 68bcf5ba16..f17524fbca 100644
--- a/data/2026/CVE-2026-43071.json
+++ b/data/2026/CVE-2026-43071.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/dcache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"45b06bb5ea96f75ad81d7ef446f832ea6b0026fe","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"426ef05e82ee52c8d0e95fc0808b7383d8352d73","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"ddd57ebce245f9c7e2f6902a6c087d6186d2385d","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"755b40903eff563768d4d96fd4ef51ec48adde3b","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"5718df131ab78897a9dd1f2e71c3ba732d4392af","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"277cedabb0ab86baae83fa58218be13c6d3e5526","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"f08fe8891c3eeb63b73f9f1f6d97aa629c821579","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"status":"affected","version":"d4c96061fddd129778ce8b70fb093aa532f422d0","versionType":"git"},{"status":"affected","version":"be2378cbffe50ce0161f0fdee914adee98af53dc","versionType":"git"},{"status":"affected","version":"a8be8af18485f9fade90e1743d940252a39eec84","versionType":"git"},{"status":"affected","version":"b5cf3193759f7cd1cfbeef11f5cf067bbce22e55","versionType":"git"},{"lessThan":"3.11","status":"affected","version":"3.10.55","versionType":"semver"},{"lessThan":"3.13","status":"affected","version":"3.12.29","versionType":"semver"},{"lessThan":"3.15","status":"affected","version":"3.14.19","versionType":"semver"},{"lessThan":"3.17","status":"affected","version":"3.16.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/dcache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5A516330-2A83-4603-8C0E-BBDFEECC27E9","versionEndExcluding":"3.11","versionStartIncluding":"3.10.55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"25875AFE-CAEF-4D99-9B64-23F2B24C08D0","versionEndExcluding":"3.13","versionStartIncluding":"3.12.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5D53296D-7B6A-4B74-A72C-45082E6C8531","versionEndExcluding":"3.15","versionStartIncluding":"3.14.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F14E1ED6-C14D-476A-BC5C-ED4B577D6D9D","versionEndExcluding":"3.17","versionStartIncluding":"3.16.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8EBFC0E0-CAF5-4E1E-9563-49D5637FEB2F","versionEndExcluding":"6.1.175","versionStartIncluding":"3.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A0F1E9A-F127-4699-A014-9E08441C9A14","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:-:*:*:*:*:*:*","matchCriteriaId":"3A351B03-87A0-405B-8A9B-488E173E1E3B","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc5:*:*:*:*:*:*","matchCriteriaId":"4223286C-F679-4FEC-B144-1C3B942BD506","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc6:*:*:*:*:*:*","matchCriteriaId":"C889AAA8-186E-433F-A31D-FF09221E1EBC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc7:*:*:*:*:*:*","matchCriteriaId":"80BC78EE-50D8-4561-A6A6-A370E72F215B","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndcache: Limit the minimal number of bucket to two\n\nThere is an OOB read problem on dentry_hashtable when user sets\n'dhash_entries=1':\n  BUG: unable to handle page fault for address: ffff888b30b774b0\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  Oops: Oops: 0000 [#1] SMP PTI\n  RIP: 0010:__d_lookup+0x56/0x120\n   Call Trace:\n    d_lookup.cold+0x16/0x5d\n    lookup_dcache+0x27/0xf0\n    lookup_one_qstr_excl+0x2a/0x180\n    start_dirop+0x55/0xa0\n    simple_start_creating+0x8d/0xa0\n    debugfs_start_creating+0x8c/0x180\n    debugfs_create_dir+0x1d/0x1c0\n    pinctrl_init+0x6d/0x140\n    do_one_initcall+0x6d/0x3d0\n    kernel_init_freeable+0x39f/0x460\n    kernel_init+0x2a/0x260\n\nThere will be only one bucket in dentry_hashtable when dhash_entries is\nset as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,\nfollowing process will access more than one buckets(which memory region\nis not allocated) in dentry_hashtable:\n d_lookup\n  b = d_hash(hash)\n    dentry_hashtable + ((u32)hashlen >> d_hash_shift)\n    // The C standard defines the behavior of right shift amounts\n    // exceeding the bit width of the operand as undefined. The\n    // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen',\n    // so 'b' will point to an unallocated memory region.\n  hlist_bl_for_each_entry_rcu(b)\n   hlist_bl_first_rcu(head)\n    h->first  // read OOB!\n\nFix it by limiting the minimal number of dentry_hashtable bucket to two,\nso that 'd_hash_shift' won't exceeds the bit width of type u32."}],"evaluatorComment":"\n","id":"CVE-2026-43071","lastModified":"2026-11-10T13:19:10.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43071","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:19.375972Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:16.420","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45b06bb5ea96f75ad81d7ef446f832ea6b0026fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/dcache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"45b06bb5ea96f75ad81d7ef446f832ea6b0026fe","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"426ef05e82ee52c8d0e95fc0808b7383d8352d73","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"ddd57ebce245f9c7e2f6902a6c087d6186d2385d","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"755b40903eff563768d4d96fd4ef51ec48adde3b","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"5718df131ab78897a9dd1f2e71c3ba732d4392af","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"277cedabb0ab86baae83fa58218be13c6d3e5526","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"lessThan":"f08fe8891c3eeb63b73f9f1f6d97aa629c821579","status":"affected","version":"99d263d4c5b2f541dfacb5391e22e8c91ea982a6","versionType":"git"},{"status":"affected","version":"d4c96061fddd129778ce8b70fb093aa532f422d0","versionType":"git"},{"status":"affected","version":"be2378cbffe50ce0161f0fdee914adee98af53dc","versionType":"git"},{"status":"affected","version":"a8be8af18485f9fade90e1743d940252a39eec84","versionType":"git"},{"status":"affected","version":"b5cf3193759f7cd1cfbeef11f5cf067bbce22e55","versionType":"git"},{"lessThan":"3.11","status":"affected","version":"3.10.55","versionType":"semver"},{"lessThan":"3.13","status":"affected","version":"3.12.29","versionType":"semver"},{"lessThan":"3.15","status":"affected","version":"3.14.19","versionType":"semver"},{"lessThan":"3.17","status":"affected","version":"3.16.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/dcache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5A516330-2A83-4603-8C0E-BBDFEECC27E9","versionEndExcluding":"3.11","versionStartIncluding":"3.10.55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"25875AFE-CAEF-4D99-9B64-23F2B24C08D0","versionEndExcluding":"3.13","versionStartIncluding":"3.12.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5D53296D-7B6A-4B74-A72C-45082E6C8531","versionEndExcluding":"3.15","versionStartIncluding":"3.14.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F14E1ED6-C14D-476A-BC5C-ED4B577D6D9D","versionEndExcluding":"3.17","versionStartIncluding":"3.16.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8EBFC0E0-CAF5-4E1E-9563-49D5637FEB2F","versionEndExcluding":"6.1.175","versionStartIncluding":"3.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A0F1E9A-F127-4699-A014-9E08441C9A14","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:-:*:*:*:*:*:*","matchCriteriaId":"3A351B03-87A0-405B-8A9B-488E173E1E3B","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc5:*:*:*:*:*:*","matchCriteriaId":"4223286C-F679-4FEC-B144-1C3B942BD506","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc6:*:*:*:*:*:*","matchCriteriaId":"C889AAA8-186E-433F-A31D-FF09221E1EBC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.17:rc7:*:*:*:*:*:*","matchCriteriaId":"80BC78EE-50D8-4561-A6A6-A370E72F215B","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndcache: Limit the minimal number of bucket to two\n\nThere is an OOB read problem on dentry_hashtable when user sets\n'dhash_entries=1':\n  BUG: unable to handle page fault for address: ffff888b30b774b0\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  Oops: Oops: 0000 [#1] SMP PTI\n  RIP: 0010:__d_lookup+0x56/0x120\n   Call Trace:\n    d_lookup.cold+0x16/0x5d\n    lookup_dcache+0x27/0xf0\n    lookup_one_qstr_excl+0x2a/0x180\n    start_dirop+0x55/0xa0\n    simple_start_creating+0x8d/0xa0\n    debugfs_start_creating+0x8c/0x180\n    debugfs_create_dir+0x1d/0x1c0\n    pinctrl_init+0x6d/0x140\n    do_one_initcall+0x6d/0x3d0\n    kernel_init_freeable+0x39f/0x460\n    kernel_init+0x2a/0x260\n\nThere will be only one bucket in dentry_hashtable when dhash_entries is\nset as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,\nfollowing process will access more than one buckets(which memory region\nis not allocated) in dentry_hashtable:\n d_lookup\n  b = d_hash(hash)\n    dentry_hashtable + ((u32)hashlen >> d_hash_shift)\n    // The C standard defines the behavior of right shift amounts\n    // exceeding the bit width of the operand as undefined. The\n    // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen',\n    // so 'b' will point to an unallocated memory region.\n  hlist_bl_for_each_entry_rcu(b)\n   hlist_bl_first_rcu(head)\n    h->first  // read OOB!\n\nFix it by limiting the minimal number of dentry_hashtable bucket to two,\nso that 'd_hash_shift' won't exceeds the bit width of type u32."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndcache: Limitar el número mínimo de cubos a dos\n\nExiste un problema de lectura OOB en dentry_hashtable cuando el usuario establece ’dhash_entries=1’:\n  BUG: no se puede manejar el fallo de página para la dirección: ffff888b30b774b0\n  #PF: acceso de lectura de supervisor en modo kernel\n  #PF: error_code(0x 0000) - página no presente\n  Oops: Oops: 0000 [#1] SMP PTI\n  RIP: 0010:__d_lookup+0x56/0x120\n   Rastro de llamada:\n    d_lookup.cold+0x16/0x5d\n    lookup_dcache+0x27/0xf0\n    lookup_one_qstr_excl+0x2a/0x180\n    start_dirop+0x55/0xa0\n    simple_start_creating+0x8d/0xa0\n    debugfs_start_creating+0x8c/0x180\n    debugfs_create_dir+0x1d/0x1c0\n    pinctrl_init+0x6d/0x140\n    do_one_initcall+0x6d/0x3d0\n    kernel_init_freeable+0x39f/0x460\n    kernel_init+0x2a/0x260\n\nHabrá solo un cubo en dentry_hashtable cuando dhash_entries se establece como uno, y d_hash_shift se calcula como 32 por dcache_init(). Entonces, el siguiente proceso accederá a más de un cubo (cuya región de memoria no está asignada) en dentry_hashtable:\n d_lookup\n  b = d_hash(hash)\n    dentry_hashtable + ((u32)hashlen >> d_hash_shift)\n    // El estándar C define el comportamiento de los desplazamientos a la derecha\n    // que exceden el ancho de bits del operando como indefinido. El\n    // resultado de ’(u32)hashlen >> d_hash_shift’ se convierte en ’hashlen’,\n    // por lo que ’b’ apuntará a una región de memoria no asignada.\n  hlist_bl_for_each_entry_rcu(b)\n   hlist_bl_first_rcu(head)\n    h  ->  first  // ¡lectura OOB!\n\nCorregirlo limitando el número mínimo de cubos de dentry_hashtable a dos, para que ’d_hash_shift’ no exceda el ancho de bits del tipo u32."}],"evaluatorComment":"\n","id":"CVE-2026-43071","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43071","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:19.375972Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:16.420","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45b06bb5ea96f75ad81d7ef446f832ea6b0026fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43072.json b/data/2026/CVE-2026-43072.json
index 4759cd4507..f5c9db3575 100644
--- a/data/2026/CVE-2026-43072.json
+++ b/data/2026/CVE-2026-43072.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_hdmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"59ece0d4d1db0cf483c4c51a58691f50ff81d3a2","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"63c11b19cdc154fa848a6c3b535bfb1dc7b60378","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"ef2ee9db13b68c5e332b77c0a7108a2d4d56e114","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"0185e0494a561edfc482507f9de89c2ad798b33d","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"9c10b83a004442c93d7a484c3d221a06a45821e1","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"0c1b117f7ba46fb8f6ebc5e0bfe5b58568c301ba","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"e597a809a2b97e927060ba182f58eb3e6101bc70","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_hdmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: platform_get_irq_byname() returns an int\n\nplatform_get_irq_byname() will return a negative value if an error\nhappens, so it should be checked and not just passed directly into\ndevm_request_threaded_irq() hoping all will be ok."}],"id":"CVE-2026-43072","lastModified":"2026-06-17T10:48:52.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-05T16:16:16.540","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0185e0494a561edfc482507f9de89c2ad798b33d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c1b117f7ba46fb8f6ebc5e0bfe5b58568c301ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/59ece0d4d1db0cf483c4c51a58691f50ff81d3a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63c11b19cdc154fa848a6c3b535bfb1dc7b60378"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c10b83a004442c93d7a484c3d221a06a45821e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e597a809a2b97e927060ba182f58eb3e6101bc70"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef2ee9db13b68c5e332b77c0a7108a2d4d56e114"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_hdmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"59ece0d4d1db0cf483c4c51a58691f50ff81d3a2","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"63c11b19cdc154fa848a6c3b535bfb1dc7b60378","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"ef2ee9db13b68c5e332b77c0a7108a2d4d56e114","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"0185e0494a561edfc482507f9de89c2ad798b33d","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"9c10b83a004442c93d7a484c3d221a06a45821e1","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"0c1b117f7ba46fb8f6ebc5e0bfe5b58568c301ba","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"},{"lessThan":"e597a809a2b97e927060ba182f58eb3e6101bc70","status":"affected","version":"f4790083c7c23b419f6a15170556950fd6a884a2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_hdmi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: platform_get_irq_byname() returns an int\n\nplatform_get_irq_byname() will return a negative value if an error\nhappens, so it should be checked and not just passed directly into\ndevm_request_threaded_irq() hoping all will be ok."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/vc4: platform_get_irq_byname() devuelve un int\n\nplatform_get_irq_byname() devolverá un valor negativo si ocurre un error, por lo que debería ser comprobado y no simplemente pasado directamente a devm_request_threaded_irq() esperando que todo esté bien."}],"id":"CVE-2026-43072","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-05T16:16:16.540","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0185e0494a561edfc482507f9de89c2ad798b33d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c1b117f7ba46fb8f6ebc5e0bfe5b58568c301ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/59ece0d4d1db0cf483c4c51a58691f50ff81d3a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63c11b19cdc154fa848a6c3b535bfb1dc7b60378"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c10b83a004442c93d7a484c3d221a06a45821e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e597a809a2b97e927060ba182f58eb3e6101bc70"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef2ee9db13b68c5e332b77c0a7108a2d4d56e114"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43073.json b/data/2026/CVE-2026-43073.json
index 28f3373d96..b34230ffe2 100644
--- a/data/2026/CVE-2026-43073.json
+++ b/data/2026/CVE-2026-43073.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/include/asm/uaccess_64.h","arch/x86/lib/copy_user_uncached_64.S","arch/x86/lib/usercopy_64.c","drivers/infiniband/sw/rdmavt/qp.c","drivers/ntb/ntb_transport.c","tools/objtool/check.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"73c2dc2c14d6a2efa5dde469546a907482af07fe","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"c6d4e0599e7e73abc04e2488dfeb7940c4039660","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"d993e1723aa2a085aa0d72e70ea889031fc225b4","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"efea91ad1729ff1853d7418e4d3bc27d085e72d0","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/include/asm/uaccess_64.h","arch/x86/lib/copy_user_uncached_64.S","arch/x86/lib/usercopy_64.c","drivers/infiniband/sw/rdmavt/qp.c","drivers/ntb/ntb_transport.c","tools/objtool/check.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7EAD2A48-6484-47C2-9723-CCEFA50056E8","versionEndExcluding":"6.12.83","versionStartIncluding":"4.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.2:-:*:*:*:*:*:*","matchCriteriaId":"37D5F2FA-B7D0-4F9D-BC97-F450E5839C7B","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86-64: rename misleadingly named '__copy_user_nocache()' function\n\nThis function was a masterclass in bad naming, for various historical\nreasons.\n\nIt claimed to be a non-cached user copy.  It is literally _neither_ of\nthose things.  It's a specialty memory copy routine that uses\nnon-temporal stores for the destination (but not the source), and that\ndoes exception handling for both source and destination accesses.\n\nAlso note that while it works for unaligned targets, any unaligned parts\n(whether at beginning or end) will not use non-temporal stores, since\nonly words and quadwords can be non-temporal on x86.\n\nThe exception handling means that it _can_ be used for user space\naccesses, but not on its own - it needs all the normal \"start user space\naccess\" logic around it.\n\nBut typically the user space access would be the source, not the\nnon-temporal destination.  That was the original intention of this,\nwhere the destination was some fragile persistent memory target that\nneeded non-temporal stores in order to catch machine check exceptions\nsynchronously and deal with them gracefully.\n\nThus that non-descriptive name: one use case was to copy from user space\ninto a non-cached kernel buffer.  However, the existing users are a mix\nof that intended use-case, and a couple of random drivers that just did\nthis as a performance tweak.\n\nSome of those random drivers then actively misused the user copying\nversion (with STAC/CLAC and all) to do kernel copies without ever even\ncaring about the exception handling, _just_ for the non-temporal\ndestination.\n\nRename it as a first small step to actually make it halfway sane, and\nchange the prototype to be more normal: it doesn't take a user pointer\nunless the caller has done the proper conversion, and the argument size\nis the full size_t (it still won't actually copy more than 4GB in one\ngo, but there's also no reason to silently truncate the size argument in\nthe caller).\n\nFinally, use this now sanely named function in the NTB code, which\nmis-used a user copy version (with STAC/CLAC and all) of this interface\ndespite it not actually being a user copy at all."}],"id":"CVE-2026-43073","lastModified":"2026-11-06T16:18:20.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:55.354058Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:16.650","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/73c2dc2c14d6a2efa5dde469546a907482af07fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6d4e0599e7e73abc04e2488dfeb7940c4039660"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d993e1723aa2a085aa0d72e70ea889031fc225b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/efea91ad1729ff1853d7418e4d3bc27d085e72d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://project-zero.issues.chromium.org/issues/496923375"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/include/asm/uaccess_64.h","arch/x86/lib/copy_user_uncached_64.S","arch/x86/lib/usercopy_64.c","drivers/infiniband/sw/rdmavt/qp.c","drivers/ntb/ntb_transport.c","tools/objtool/check.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"73c2dc2c14d6a2efa5dde469546a907482af07fe","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"c6d4e0599e7e73abc04e2488dfeb7940c4039660","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"d993e1723aa2a085aa0d72e70ea889031fc225b4","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"efea91ad1729ff1853d7418e4d3bc27d085e72d0","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"},{"lessThan":"d187a86de793f84766ea40b9ade7ac60aabbb4fe","status":"affected","version":"06917f753547e6bba8a5d17f79971d1c071a70dd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/include/asm/uaccess_64.h","arch/x86/lib/copy_user_uncached_64.S","arch/x86/lib/usercopy_64.c","drivers/infiniband/sw/rdmavt/qp.c","drivers/ntb/ntb_transport.c","tools/objtool/check.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7EAD2A48-6484-47C2-9723-CCEFA50056E8","versionEndExcluding":"6.12.83","versionStartIncluding":"4.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.2:-:*:*:*:*:*:*","matchCriteriaId":"37D5F2FA-B7D0-4F9D-BC97-F450E5839C7B","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86-64: rename misleadingly named '__copy_user_nocache()' function\n\nThis function was a masterclass in bad naming, for various historical\nreasons.\n\nIt claimed to be a non-cached user copy.  It is literally _neither_ of\nthose things.  It's a specialty memory copy routine that uses\nnon-temporal stores for the destination (but not the source), and that\ndoes exception handling for both source and destination accesses.\n\nAlso note that while it works for unaligned targets, any unaligned parts\n(whether at beginning or end) will not use non-temporal stores, since\nonly words and quadwords can be non-temporal on x86.\n\nThe exception handling means that it _can_ be used for user space\naccesses, but not on its own - it needs all the normal \"start user space\naccess\" logic around it.\n\nBut typically the user space access would be the source, not the\nnon-temporal destination.  That was the original intention of this,\nwhere the destination was some fragile persistent memory target that\nneeded non-temporal stores in order to catch machine check exceptions\nsynchronously and deal with them gracefully.\n\nThus that non-descriptive name: one use case was to copy from user space\ninto a non-cached kernel buffer.  However, the existing users are a mix\nof that intended use-case, and a couple of random drivers that just did\nthis as a performance tweak.\n\nSome of those random drivers then actively misused the user copying\nversion (with STAC/CLAC and all) to do kernel copies without ever even\ncaring about the exception handling, _just_ for the non-temporal\ndestination.\n\nRename it as a first small step to actually make it halfway sane, and\nchange the prototype to be more normal: it doesn't take a user pointer\nunless the caller has done the proper conversion, and the argument size\nis the full size_t (it still won't actually copy more than 4GB in one\ngo, but there's also no reason to silently truncate the size argument in\nthe caller).\n\nFinally, use this now sanely named function in the NTB code, which\nmis-used a user copy version (with STAC/CLAC and all) of this interface\ndespite it not actually being a user copy at all."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86-64: renombrar la función con el nombre engañoso ’__copy_user_nocache()’\n\nEsta función fue una clase magistral de mala denominación, por varias razones históricas.\n\nAfirmaba ser una copia de usuario no cacheada. Literalmente _no_ es ninguna de esas dos cosas. Es una rutina de copia de memoria especializada que utiliza almacenamientos no temporales para el destino (pero no para el origen), y que realiza manejo de excepciones para los accesos tanto de origen como de destino.\n\nTambién hay que tener en cuenta que, si bien funciona para destinos no alineados, cualquier parte no alineada (ya sea al principio o al final) no utilizará almacenamientos no temporales, ya que solo las palabras y las palabras cuádruples pueden ser no temporales en x86.\n\nEl manejo de excepciones significa que _puede_ ser utilizada para accesos al espacio de usuario, pero no por sí sola; necesita toda la lógica normal de ’inicio de acceso al espacio de usuario’ a su alrededor.\n\nPero típicamente el acceso al espacio de usuario sería el origen, no el destino no temporal. Esa fue la intención original de esto, donde el destino era algún objetivo de memoria persistente frágil que necesitaba almacenamientos no temporales para capturar excepciones de verificación de máquina de forma síncrona y manejarlas con elegancia.\n\nDe ahí ese nombre no descriptivo: un caso de uso era copiar desde el espacio de usuario a un búfer del kernel no cacheado. Sin embargo, los usuarios existentes son una mezcla de ese caso de uso previsto y un par de controladores aleatorios que simplemente hicieron esto como un ajuste de rendimiento.\n\nAlgunos de esos controladores aleatorios luego hicieron un mal uso activo de la versión de copia de usuario (con STAC/CLAC y todo) para hacer copias del kernel sin siquiera preocuparse por el manejo de excepciones, _solo_ por el destino no temporal.\n\nRenombrarla como un primer pequeño paso para hacerla realmente medio sensata, y cambiar el prototipo para que sea más normal: no toma un puntero de usuario a menos que el llamador haya realizado la conversión adecuada, y el tamaño del argumento es el size_t completo (todavía no copiará realmente más de 4GB de una sola vez, pero tampoco hay razón para truncar silenciosamente el argumento de tamaño en el llamador).\n\nFinalmente, usar esta función ahora con un nombre sensato en el código NTB, que hizo un mal uso de una versión de copia de usuario (con STAC/CLAC y todo) de esta interfaz a pesar de que en realidad no era una copia de usuario en absoluto."}],"id":"CVE-2026-43073","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:55.354058Z","version":"2.0.3"}}]},"published":"2026-05-05T16:16:16.650","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/73c2dc2c14d6a2efa5dde469546a907482af07fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6d4e0599e7e73abc04e2488dfeb7940c4039660"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d993e1723aa2a085aa0d72e70ea889031fc225b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/efea91ad1729ff1853d7418e4d3bc27d085e72d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://project-zero.issues.chromium.org/issues/496923375"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43074.json b/data/2026/CVE-2026-43074.json
index a25d78bd55..d615a17127 100644
--- a/data/2026/CVE-2026-43074.json
+++ b/data/2026/CVE-2026-43074.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/eventpoll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"902120be4f44947df6311002addc7faf69bdbff1","status":"affected","version":"f2451def095c1743adcfcb0cb5dadc86034e162a","versionType":"git"},{"lessThan":"a6d57084372161f86660bc4607784420e00efe2c","status":"affected","version":"a1f93804449d13f97dabd4b996817de4bf1ed67a","versionType":"git"},{"lessThan":"a6566cd33f6f967a7651ebf2ce0dd31572e319cf","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"},{"lessThan":"5b1173b165421561db29f30afc7e97d940a398a9","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"},{"lessThan":"7e8083f5eeedab0f460063b9c2c14c9a4e71a427","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"},{"lessThan":"ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"},{"lessThan":"07712db80857d5d09ae08f3df85a708ecfc3b61f","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/eventpoll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"03382702-BC98-477F-87AB-A5B1011E1D0C","versionEndExcluding":"6.6.136","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: defer struct eventpoll free to RCU grace period\n\nIn certain situations, ep_free() in eventpoll.c will kfree the epi->ep\neventpoll struct while it still being used by another concurrent thread.\nDefer the kfree() to an RCU callback to prevent UAF."}],"id":"CVE-2026-43074","lastModified":"2026-10-19T20:18:04.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:21.825973Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:20.343","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07712db80857d5d09ae08f3df85a708ecfc3b61f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5b1173b165421561db29f30afc7e97d940a398a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e8083f5eeedab0f460063b9c2c14c9a4e71a427"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/902120be4f44947df6311002addc7faf69bdbff1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6566cd33f6f967a7651ebf2ce0dd31572e319cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a6d57084372161f86660bc4607784420e00efe2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/eventpoll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"902120be4f44947df6311002addc7faf69bdbff1","status":"affected","version":"f2451def095c1743adcfcb0cb5dadc86034e162a","versionType":"git"},{"lessThan":"a6d57084372161f86660bc4607784420e00efe2c","status":"affected","version":"a1f93804449d13f97dabd4b996817de4bf1ed67a","versionType":"git"},{"lessThan":"a6566cd33f6f967a7651ebf2ce0dd31572e319cf","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"},{"lessThan":"5b1173b165421561db29f30afc7e97d940a398a9","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"},{"lessThan":"7e8083f5eeedab0f460063b9c2c14c9a4e71a427","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"},{"lessThan":"ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"},{"lessThan":"07712db80857d5d09ae08f3df85a708ecfc3b61f","status":"affected","version":"58c9b016e12855286370dfb704c08498edbc857a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/eventpoll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"03382702-BC98-477F-87AB-A5B1011E1D0C","versionEndExcluding":"6.6.136","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: defer struct eventpoll free to RCU grace period\n\nIn certain situations, ep_free() in eventpoll.c will kfree the epi->ep\neventpoll struct while it still being used by another concurrent thread.\nDefer the kfree() to an RCU callback to prevent UAF."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\neventpoll: aplazar la liberación de la estructura eventpoll al período de gracia de RCU\n\nEn ciertas situaciones, ep_free() en eventpoll.c liberará con kfree la estructura eventpoll epi  ->  ep mientras aún está siendo utilizada por otro hilo concurrente. Aplazar el kfree() a una devolución de llamada RCU para prevenir UAF."}],"id":"CVE-2026-43074","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:21.825973Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:20.343","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07712db80857d5d09ae08f3df85a708ecfc3b61f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5b1173b165421561db29f30afc7e97d940a398a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e8083f5eeedab0f460063b9c2c14c9a4e71a427"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/902120be4f44947df6311002addc7faf69bdbff1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6566cd33f6f967a7651ebf2ce0dd31572e319cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a6d57084372161f86660bc4607784420e00efe2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43075.json b/data/2026/CVE-2026-43075.json
index 84bd8bf096..296ae41f99 100644
--- a/data/2026/CVE-2026-43075.json
+++ b/data/2026/CVE-2026-43075.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"22df7d4de9c5cd42edf855a1de25f2106088c4c6","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"e2c9dc6b6e96f3585f2a1062ca3374a52db0938f","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"947f953978b0d9463498d548d0f054f5a75be2e9","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"0c1af902223b6fcedb60904ca0b551254686c7b9","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"69d3c69ade1e4285ab4ca48fe7acee0767e65604","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"7bc5da4842bed3252d26e742213741a4d0ac1b14","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.24"},{"lessThan":"2.6.24","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3C45350C-5A79-40F0-B6B0-BF9ED7FA81B4","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.24.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.24:-:*:*:*:*:*:*","matchCriteriaId":"6F3E61F3-1CF1-4176-94CD-89A408BCFC96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix out-of-bounds write in ocfs2_write_end_inline\n\nKASAN reports a use-after-free write of 4086 bytes in\nocfs2_write_end_inline, called from ocfs2_write_end_nolock during a\ncopy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on\na loop device.  The actual bug is an out-of-bounds write past the inode\nblock buffer, not a true use-after-free.  The write overflows into an\nadjacent freed page, which KASAN reports as UAF.\n\nThe root cause is that ocfs2_try_to_write_inline_data trusts the on-disk\nid_count field to determine whether a write fits in inline data.  On a\ncorrupted filesystem, id_count can exceed the physical maximum inline data\ncapacity, causing writes to overflow the inode block buffer.\n\nCall trace (crash path):\n\n   vfs_copy_file_range (fs/read_write.c:1634)\n     do_splice_direct\n       splice_direct_to_actor\n         iter_file_splice_write\n           ocfs2_file_write_iter\n             generic_perform_write\n               ocfs2_write_end\n                 ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n                   ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n                     memcpy_from_folio     <-- KASAN: write OOB\n\nSo add id_count upper bound check in ocfs2_validate_inode_block() to\nalongside the existing i_size check to fix it."}],"id":"CVE-2026-43075","lastModified":"2026-06-17T10:48:53.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:20.463","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/22df7d4de9c5cd42edf855a1de25f2106088c4c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"22df7d4de9c5cd42edf855a1de25f2106088c4c6","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"e2c9dc6b6e96f3585f2a1062ca3374a52db0938f","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"947f953978b0d9463498d548d0f054f5a75be2e9","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"0c1af902223b6fcedb60904ca0b551254686c7b9","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"69d3c69ade1e4285ab4ca48fe7acee0767e65604","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"},{"lessThan":"7bc5da4842bed3252d26e742213741a4d0ac1b14","status":"affected","version":"1afc32b952335f665327a1a9001ba1b44bb76fd9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.24"},{"lessThan":"2.6.24","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3C45350C-5A79-40F0-B6B0-BF9ED7FA81B4","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.24.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.24:-:*:*:*:*:*:*","matchCriteriaId":"6F3E61F3-1CF1-4176-94CD-89A408BCFC96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix out-of-bounds write in ocfs2_write_end_inline\n\nKASAN reports a use-after-free write of 4086 bytes in\nocfs2_write_end_inline, called from ocfs2_write_end_nolock during a\ncopy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on\na loop device.  The actual bug is an out-of-bounds write past the inode\nblock buffer, not a true use-after-free.  The write overflows into an\nadjacent freed page, which KASAN reports as UAF.\n\nThe root cause is that ocfs2_try_to_write_inline_data trusts the on-disk\nid_count field to determine whether a write fits in inline data.  On a\ncorrupted filesystem, id_count can exceed the physical maximum inline data\ncapacity, causing writes to overflow the inode block buffer.\n\nCall trace (crash path):\n\n   vfs_copy_file_range (fs/read_write.c:1634)\n     do_splice_direct\n       splice_direct_to_actor\n         iter_file_splice_write\n           ocfs2_file_write_iter\n             generic_perform_write\n               ocfs2_write_end\n                 ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n                   ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n                     memcpy_from_folio     <-- KASAN: write OOB\n\nSo add id_count upper bound check in ocfs2_validate_inode_block() to\nalongside the existing i_size check to fix it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nocfs2: corrección de escritura fuera de límites en ocfs2_write_end_inline\n\nKASAN informa una escritura de uso después de liberación de 4086 bytes en ocfs2_write_end_inline, llamada desde ocfs2_write_end_nolock durante un fallback de splice de copy_file_range en un sistema de archivos ocfs2 corrupto montado en un dispositivo de bucle. El error real es una escritura fuera de límites más allá del búfer del bloque de inodo, no un verdadero uso después de liberación. La escritura desborda en una página adyacente liberada, que KASAN informa como UAF.\n\nLa causa raíz es que ocfs2_try_to_write_inline_data confía en el campo id_count en disco para determinar si una escritura cabe en los datos en línea. En un sistema de archivos corrupto, id_count puede exceder la capacidad máxima física de datos en línea, causando que las escrituras desborden el búfer del bloque de inodo.\n\nRuta de llamada (ruta de fallo):\n\n   vfs_copy_file_range (fs/read_write.c:1634)\n     do_splice_direct\n       splice_direct_to_actor\n         iter_file_splice_write\n           ocfs2_file_write_iter\n             generic_perform_write\n               ocfs2_write_end\n                 ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n                   ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n                     memcpy_from_folio       <-  - KASAN: escritura OOB\n\nPor lo tanto, se añade una comprobación de límite superior de id_count en ocfs2_validate_inode_block() junto con la comprobación existente de i_size para solucionarlo."}],"id":"CVE-2026-43075","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:20.463","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/22df7d4de9c5cd42edf855a1de25f2106088c4c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43076.json b/data/2026/CVE-2026-43076.json
index 07ef3ab115..6e76575062 100644
--- a/data/2026/CVE-2026-43076.json
+++ b/data/2026/CVE-2026-43076.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d012c782abcabe68b5b9e71be58a15e9f9d83dc1","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"bcd46bc261b215b3b12c557a978299eafa02ecdd","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"131c0b573e1b467b7d553e9ff38003f1acd8f5f2","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"37f074e65f24f10f8d8df224a572e4cb9e6faf63","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"cd2d765aa7157f852999842af32148128c735d39","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"77d0295725109d77f5854ef5b58c0d06c08168cc","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"1524af3685b35feac76662cc551cbc37bd14775f","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.24"},{"lessThan":"2.6.24","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3C45350C-5A79-40F0-B6B0-BF9ED7FA81B4","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.24.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.24:-:*:*:*:*:*:*","matchCriteriaId":"6F3E61F3-1CF1-4176-94CD-89A408BCFC96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate inline data i_size during inode read\n\nWhen reading an inode from disk, ocfs2_validate_inode_block() performs\nvarious sanity checks but does not validate the size of inline data.  If\nthe filesystem is corrupted, an inode's i_size can exceed the actual\ninline data capacity (id_count).\n\nThis causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data\nbuffer, triggering a use-after-free when accessing directory entries from\nfreed memory.\n\nIn the syzbot report:\n  - i_size was 1099511627576 bytes (~1TB)\n  - Actual inline data capacity (id_count) is typically <256 bytes\n  - A garbage rec_len (54648) caused ctx->pos to jump out of bounds\n  - This triggered a UAF in ocfs2_check_dir_entry()\n\nFix by adding a validation check in ocfs2_validate_inode_block() to ensure\ninodes with inline data have i_size <= id_count.  This catches the\ncorruption early during inode read and prevents all downstream code from\noperating on invalid data."}],"id":"CVE-2026-43076","lastModified":"2026-06-17T10:48:53.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:20.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/131c0b573e1b467b7d553e9ff38003f1acd8f5f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1524af3685b35feac76662cc551cbc37bd14775f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37f074e65f24f10f8d8df224a572e4cb9e6faf63"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77d0295725109d77f5854ef5b58c0d06c08168cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bcd46bc261b215b3b12c557a978299eafa02ecdd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cd2d765aa7157f852999842af32148128c735d39"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d012c782abcabe68b5b9e71be58a15e9f9d83dc1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d012c782abcabe68b5b9e71be58a15e9f9d83dc1","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"bcd46bc261b215b3b12c557a978299eafa02ecdd","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"131c0b573e1b467b7d553e9ff38003f1acd8f5f2","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"37f074e65f24f10f8d8df224a572e4cb9e6faf63","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"cd2d765aa7157f852999842af32148128c735d39","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"77d0295725109d77f5854ef5b58c0d06c08168cc","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"},{"lessThan":"1524af3685b35feac76662cc551cbc37bd14775f","status":"affected","version":"23193e513d1cd69411469f028d56fd175d4a6b07","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.24"},{"lessThan":"2.6.24","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3C45350C-5A79-40F0-B6B0-BF9ED7FA81B4","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.24.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.24:-:*:*:*:*:*:*","matchCriteriaId":"6F3E61F3-1CF1-4176-94CD-89A408BCFC96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate inline data i_size during inode read\n\nWhen reading an inode from disk, ocfs2_validate_inode_block() performs\nvarious sanity checks but does not validate the size of inline data.  If\nthe filesystem is corrupted, an inode's i_size can exceed the actual\ninline data capacity (id_count).\n\nThis causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data\nbuffer, triggering a use-after-free when accessing directory entries from\nfreed memory.\n\nIn the syzbot report:\n  - i_size was 1099511627576 bytes (~1TB)\n  - Actual inline data capacity (id_count) is typically <256 bytes\n  - A garbage rec_len (54648) caused ctx->pos to jump out of bounds\n  - This triggered a UAF in ocfs2_check_dir_entry()\n\nFix by adding a validation check in ocfs2_validate_inode_block() to ensure\ninodes with inline data have i_size <= id_count.  This catches the\ncorruption early during inode read and prevents all downstream code from\noperating on invalid data."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: ocfs2: validar el i_size de los datos en línea durante la lectura de inodos Al leer un inodo del disco, ocfs2_validate_inode_block() realiza varias comprobaciones de coherencia, pero no valida el tamaño de los datos en línea. Si el sistema de archivos está corrupto, el i_size de un inodo puede exceder la capacidad real de los datos en línea (id_count). Esto provoca que ocfs2_dir_foreach_blk_id() itere más allá del búfer de datos en línea, lo que desencadena un uso después de liberación al acceder a entradas de directorio desde memoria liberada. En el informe de syzbot: - el i_size era de 1099511627576 bytes (~1TB) - La capacidad real de los datos en línea (id_count) es típicamente menor que 256 bytes - Un rec_len (54648) erróneo hizo que ctx  ->  pos saltara fuera de los límites - Esto desencadenó un UAF en ocfs2_check_dir_entry() Solución: añadiendo una comprobación de validación en ocfs2_validate_inode_block() para asegurar que los inodos con datos en línea tengan i_size <= id_count. Esto detecta la corrupción tempranamente durante la lectura del inodo y evita que todo el código posterior opere con datos inválidos."}],"id":"CVE-2026-43076","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:20.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/131c0b573e1b467b7d553e9ff38003f1acd8f5f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1524af3685b35feac76662cc551cbc37bd14775f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37f074e65f24f10f8d8df224a572e4cb9e6faf63"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77d0295725109d77f5854ef5b58c0d06c08168cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bcd46bc261b215b3b12c557a978299eafa02ecdd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cd2d765aa7157f852999842af32148128c735d39"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d012c782abcabe68b5b9e71be58a15e9f9d83dc1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43077.json b/data/2026/CVE-2026-43077.json
index dfdca5cd22..4a0c2e057b 100644
--- a/data/2026/CVE-2026-43077.json
+++ b/data/2026/CVE-2026-43077.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/algif_aead.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"74a66fdb5282d89e348b00c42cfca3a936946d94","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"fd427dd84f224309afbcc2cb67c7bb770a01265c","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"1c76b5675119f694458293a2a81f40731c69bd32","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"e86ab1e5661386a874fbb8551f0c04b8e9f8ad22","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"af2fa2fbbced26129813274b8b3f7705f280e174","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"78cea133daf721698876e56135049a96d39d610a","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"3afdc15d6173614d7d834517d9b65e7aa5a08548","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"3d14bd48e3a77091cbce637a12c2ae31b4a1687c","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/algif_aead.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E49F4532-8422-46F7-B2E8-96E820919D16","versionEndExcluding":"5.10.254","versionStartIncluding":"4.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A0F1E9A-F127-4699-A014-9E08441C9A14","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*","matchCriteriaId":"7875AA30-1F6F-470C-A52D-ECBD6663CEC5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Fix minimum RX size check for decryption\n\nThe check for the minimum receive buffer size did not take the\ntag size into account during decryption.  Fix this by adding the\nrequired extra length."}],"id":"CVE-2026-43077","lastModified":"2026-11-06T16:18:21.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:59.443474Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:20.707","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c76b5675119f694458293a2a81f40731c69bd32"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3afdc15d6173614d7d834517d9b65e7aa5a08548"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d14bd48e3a77091cbce637a12c2ae31b4a1687c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74a66fdb5282d89e348b00c42cfca3a936946d94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78cea133daf721698876e56135049a96d39d610a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af2fa2fbbced26129813274b8b3f7705f280e174"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e86ab1e5661386a874fbb8551f0c04b8e9f8ad22"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fd427dd84f224309afbcc2cb67c7bb770a01265c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/algif_aead.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"74a66fdb5282d89e348b00c42cfca3a936946d94","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"fd427dd84f224309afbcc2cb67c7bb770a01265c","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"1c76b5675119f694458293a2a81f40731c69bd32","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"e86ab1e5661386a874fbb8551f0c04b8e9f8ad22","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"af2fa2fbbced26129813274b8b3f7705f280e174","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"78cea133daf721698876e56135049a96d39d610a","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"3afdc15d6173614d7d834517d9b65e7aa5a08548","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"},{"lessThan":"3d14bd48e3a77091cbce637a12c2ae31b4a1687c","status":"affected","version":"d887c52d6ae43aeebd249b5f2f1333e60236aa60","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/algif_aead.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E49F4532-8422-46F7-B2E8-96E820919D16","versionEndExcluding":"5.10.254","versionStartIncluding":"4.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A0F1E9A-F127-4699-A014-9E08441C9A14","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*","matchCriteriaId":"7875AA30-1F6F-470C-A52D-ECBD6663CEC5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Fix minimum RX size check for decryption\n\nThe check for the minimum receive buffer size did not take the\ntag size into account during decryption.  Fix this by adding the\nrequired extra length."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: algif_aead - Corrección de la comprobación del tamaño mínimo de RX para el descifrado\n\nLa comprobación del tamaño mínimo del búfer de recepción no tuvo en cuenta el tamaño de la etiqueta durante el descifrado. Corregir esto añadiendo la longitud extra requerida."}],"id":"CVE-2026-43077","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:27:59.443474Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:20.707","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c76b5675119f694458293a2a81f40731c69bd32"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3afdc15d6173614d7d834517d9b65e7aa5a08548"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d14bd48e3a77091cbce637a12c2ae31b4a1687c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74a66fdb5282d89e348b00c42cfca3a936946d94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78cea133daf721698876e56135049a96d39d610a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af2fa2fbbced26129813274b8b3f7705f280e174"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e86ab1e5661386a874fbb8551f0c04b8e9f8ad22"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fd427dd84f224309afbcc2cb67c7bb770a01265c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43078.json b/data/2026/CVE-2026-43078.json
index 1bc60fbbdf..d7e8ac3948 100644
--- a/data/2026/CVE-2026-43078.json
+++ b/data/2026/CVE-2026-43078.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/af_alg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"2b781d1d4f933990318bcc5c68fb75a717379e42","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"f7826bc0b39928a4a22f6b815dd9940b22a63503","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"710a4ce5d7afd9fe082c75dec282ab4a11c0fe71","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"c8369a6d62f5abde9cbd4b62c45bf4b996be2468","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"9532501e0f1b200ea80baa0e33e0b06da10bb271","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"31d00156e50ecad37f2cb6cbf04aaa9a260505ef","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/af_alg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.137","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.85","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E49F4532-8422-46F7-B2E8-96E820919D16","versionEndExcluding":"5.10.254","versionStartIncluding":"4.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3EF52-168A-4348-8F5F-356C9EB69261","versionEndExcluding":"6.6.137","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F17D292D-A9B5-4DC7-8002-51AB95335606","versionEndExcluding":"6.12.85","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*","matchCriteriaId":"7875AA30-1F6F-470C-A52D-ECBD6663CEC5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl\n\nWhen page reassignment was added to af_alg_pull_tsgl the original\nloop wasn't updated so it may try to reassign one more page than\nnecessary.\n\nAdd the check to the reassignment so that this does not happen.\n\nAlso update the comment which still refers to the obsolete offset\nargument."}],"id":"CVE-2026-43078","lastModified":"2026-10-19T20:18:04.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:24.515362Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:20.853","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b781d1d4f933990318bcc5c68fb75a717379e42"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/31d00156e50ecad37f2cb6cbf04aaa9a260505ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/710a4ce5d7afd9fe082c75dec282ab4a11c0fe71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9532501e0f1b200ea80baa0e33e0b06da10bb271"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8369a6d62f5abde9cbd4b62c45bf4b996be2468"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7826bc0b39928a4a22f6b815dd9940b22a63503"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/af_alg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"2b781d1d4f933990318bcc5c68fb75a717379e42","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"f7826bc0b39928a4a22f6b815dd9940b22a63503","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"710a4ce5d7afd9fe082c75dec282ab4a11c0fe71","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"c8369a6d62f5abde9cbd4b62c45bf4b996be2468","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"9532501e0f1b200ea80baa0e33e0b06da10bb271","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"31d00156e50ecad37f2cb6cbf04aaa9a260505ef","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/af_alg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.137","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.85","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E49F4532-8422-46F7-B2E8-96E820919D16","versionEndExcluding":"5.10.254","versionStartIncluding":"4.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3EF52-168A-4348-8F5F-356C9EB69261","versionEndExcluding":"6.6.137","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F17D292D-A9B5-4DC7-8002-51AB95335606","versionEndExcluding":"6.12.85","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*","matchCriteriaId":"7875AA30-1F6F-470C-A52D-ECBD6663CEC5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl\n\nWhen page reassignment was added to af_alg_pull_tsgl the original\nloop wasn't updated so it may try to reassign one more page than\nnecessary.\n\nAdd the check to the reassignment so that this does not happen.\n\nAlso update the comment which still refers to the obsolete offset\nargument."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: af_alg - Corrección de desbordamiento de reasignación de página en af_alg_pull_tsgl\n\nCuando se añadió la reasignación de página a af_alg_pull_tsgl, el bucle original no se actualizó, por lo que podría intentar reasignar una página más de lo necesario.\n\nAñadir la comprobación a la reasignación para que esto no ocurra.\n\nTambién actualizar el comentario que todavía hace referencia al argumento de desplazamiento obsoleto."}],"id":"CVE-2026-43078","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:24.515362Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:20.853","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b781d1d4f933990318bcc5c68fb75a717379e42"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/31d00156e50ecad37f2cb6cbf04aaa9a260505ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/710a4ce5d7afd9fe082c75dec282ab4a11c0fe71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9532501e0f1b200ea80baa0e33e0b06da10bb271"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8369a6d62f5abde9cbd4b62c45bf4b996be2468"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dea5fcf085f977b6c2de1b2d4ec4767b6c840d1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7826bc0b39928a4a22f6b815dd9940b22a63503"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa48d3ea9cdbfb28c1fd6756c6c5cd01351aa51e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43079.json b/data/2026/CVE-2026-43079.json
index d6ad99cfc5..ace2c7a028 100644
--- a/data/2026/CVE-2026-43079.json
+++ b/data/2026/CVE-2026-43079.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/events/intel/uncore_discovery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d18da11a5e21eac7651c8897e5e0908f6c2bc9de","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"dfcba8c8674cead6c88a2f269b71aa4efd3d384a","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"cfab2c817d2e7e0bee98d66850246ce842ed5f18","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"6cfc187d85f18f976d0fe527d4c6f6171542cc19","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"f34feda8e0c9535fee3f8870ce8bab53c2798f71","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"7a2cb02437d92ed14fe494d8994056d5bd2c72b4","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"7b568e9eba2fad89a696f22f0413d44cf4a1f892","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/events/intel/uncore_discovery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9F743086-ED4F-414C-BC47-C10ACDAA072C","versionEndExcluding":"5.15.209","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92385813-D91D-480D-83A1-F423D2CBB2BA","versionEndExcluding":"6.1.175","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A0F1E9A-F127-4699-A014-9E08441C9A14","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Skip discovery table for offline dies\n\nThis warning can be triggered if NUMA is disabled and the system\nboots with fewer CPUs than the number of CPUs in die 0.\n\nWARNING: CPU: 9 PID: 7257 at uncore.c:1157 uncore_pci_pmu_register+0x136/0x160 [intel_uncore]\n\nCurrently, the discovery table continues to be parsed even if all CPUs\nin the associated die are offline.  This can lead to an array overflow\nat \"pmu->boxes[die] = box\" in uncore_pci_pmu_register(), which may\ntrigger the warning above or cause other issues."}],"id":"CVE-2026-43079","lastModified":"2026-11-06T16:18:21.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:04.991226Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:20.990","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6cfc187d85f18f976d0fe527d4c6f6171542cc19"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a2cb02437d92ed14fe494d8994056d5bd2c72b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b568e9eba2fad89a696f22f0413d44cf4a1f892"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cfab2c817d2e7e0bee98d66850246ce842ed5f18"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d18da11a5e21eac7651c8897e5e0908f6c2bc9de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dfcba8c8674cead6c88a2f269b71aa4efd3d384a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f34feda8e0c9535fee3f8870ce8bab53c2798f71"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/events/intel/uncore_discovery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d18da11a5e21eac7651c8897e5e0908f6c2bc9de","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"dfcba8c8674cead6c88a2f269b71aa4efd3d384a","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"cfab2c817d2e7e0bee98d66850246ce842ed5f18","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"6cfc187d85f18f976d0fe527d4c6f6171542cc19","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"f34feda8e0c9535fee3f8870ce8bab53c2798f71","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"7a2cb02437d92ed14fe494d8994056d5bd2c72b4","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"},{"lessThan":"7b568e9eba2fad89a696f22f0413d44cf4a1f892","status":"affected","version":"edae1f06c2cda41edffc93de6aedc8ba8dc883c3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/events/intel/uncore_discovery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9F743086-ED4F-414C-BC47-C10ACDAA072C","versionEndExcluding":"5.15.209","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92385813-D91D-480D-83A1-F423D2CBB2BA","versionEndExcluding":"6.1.175","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A0F1E9A-F127-4699-A014-9E08441C9A14","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/uncore: Skip discovery table for offline dies\n\nThis warning can be triggered if NUMA is disabled and the system\nboots with fewer CPUs than the number of CPUs in die 0.\n\nWARNING: CPU: 9 PID: 7257 at uncore.c:1157 uncore_pci_pmu_register+0x136/0x160 [intel_uncore]\n\nCurrently, the discovery table continues to be parsed even if all CPUs\nin the associated die are offline.  This can lead to an array overflow\nat \"pmu->boxes[die] = box\" in uncore_pci_pmu_register(), which may\ntrigger the warning above or cause other issues."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nperf/x86/intel/uncore: Omitir tabla de descubrimiento para dies fuera de línea\n\nEsta advertencia puede activarse si NUMA está deshabilitado y el sistema arranca con menos CPUs que el número de CPUs en el die 0.\n\nADVERTENCIA: CPU: 9 PID: 7257 en uncore.c:1157 uncore_pci_pmu_register+0x136/0x160 [intel_uncore]\n\nActualmente, la tabla de descubrimiento continúa siendo analizada incluso si todas las CPUs en el die asociado están fuera de línea. Esto puede llevar a un desbordamiento de array en ’pmu  ->  boxes[die] = box’ en uncore_pci_pmu_register(), lo que puede activar la advertencia anterior o causar otros problemas."}],"id":"CVE-2026-43079","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:04.991226Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:20.990","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6cfc187d85f18f976d0fe527d4c6f6171542cc19"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a2cb02437d92ed14fe494d8994056d5bd2c72b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b568e9eba2fad89a696f22f0413d44cf4a1f892"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cfab2c817d2e7e0bee98d66850246ce842ed5f18"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d18da11a5e21eac7651c8897e5e0908f6c2bc9de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dfcba8c8674cead6c88a2f269b71aa4efd3d384a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f34feda8e0c9535fee3f8870ce8bab53c2798f71"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43084.json b/data/2026/CVE-2026-43084.json
index 696294a478..3e27b9e19b 100644
--- a/data/2026/CVE-2026-43084.json
+++ b/data/2026/CVE-2026-43084.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_queue.h","net/netfilter/nfnetlink_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"22730cb96093b5be0609063bbb1923dbecd61252","status":"affected","version":"371de2bef6582a3f58049b3d18e190924af9c9a0","versionType":"git"},{"lessThan":"41e3652a178cb0eecd48e0e6e27fbb73a004046a","status":"affected","version":"870e3e63da8e88daffe9d692a025c711658018a8","versionType":"git"},{"lessThan":"9e5ebef91120d2764aefe557c3a484b6288f341f","status":"affected","version":"70e2e3ce4f6841e12ec1c104fc76c0e707398ec4","versionType":"git"},{"lessThan":"936206e3f6ff411581e615e930263d6f8b78df9d","status":"affected","version":"e19079adcd26a25d7d3e586b1837493361fdf8b6","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_queue.h","net/netfilter/nfnetlink_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.12.83","status":"affected","version":"6.12.75","versionType":"semver"},{"lessThan":"6.18.24","status":"affected","version":"6.18.14","versionType":"semver"},{"lessThan":"6.19.14","status":"affected","version":"6.19.4","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E1A21D87-0999-4B99-8C46-E845E91596BC","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12.75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F1EF34AA-110D-41A4-A945-0F3F8D525789","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92491DD1-C41C-4797-A5EB-8523985265BA","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: make hash table per queue\n\nSharing a global hash table among all queues is tempting, but\nit can cause crash:\n\nBUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]\n[..]\n nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]\n nfnetlink_rcv_msg+0x46a/0x930\n kmem_cache_alloc_node_noprof+0x11e/0x450\n\nstruct nf_queue_entry is freed via kfree, but parallel cpu can still\nencounter such an nf_queue_entry when walking the list.\n\nAlternative fix is to free the nf_queue_entry via kfree_rcu() instead,\nbut as we have to alloc/free for each skb this will cause more mem\npressure."}],"id":"CVE-2026-43084","lastModified":"2026-10-19T20:18:05.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:29.678333Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:21.610","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22730cb96093b5be0609063bbb1923dbecd61252"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41e3652a178cb0eecd48e0e6e27fbb73a004046a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/936206e3f6ff411581e615e930263d6f8b78df9d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e5ebef91120d2764aefe557c3a484b6288f341f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_queue.h","net/netfilter/nfnetlink_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"22730cb96093b5be0609063bbb1923dbecd61252","status":"affected","version":"371de2bef6582a3f58049b3d18e190924af9c9a0","versionType":"git"},{"lessThan":"41e3652a178cb0eecd48e0e6e27fbb73a004046a","status":"affected","version":"870e3e63da8e88daffe9d692a025c711658018a8","versionType":"git"},{"lessThan":"9e5ebef91120d2764aefe557c3a484b6288f341f","status":"affected","version":"70e2e3ce4f6841e12ec1c104fc76c0e707398ec4","versionType":"git"},{"lessThan":"936206e3f6ff411581e615e930263d6f8b78df9d","status":"affected","version":"e19079adcd26a25d7d3e586b1837493361fdf8b6","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_queue.h","net/netfilter/nfnetlink_queue.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.12.83","status":"affected","version":"6.12.75","versionType":"semver"},{"lessThan":"6.18.24","status":"affected","version":"6.18.14","versionType":"semver"},{"lessThan":"6.19.14","status":"affected","version":"6.19.4","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E1A21D87-0999-4B99-8C46-E845E91596BC","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12.75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F1EF34AA-110D-41A4-A945-0F3F8D525789","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92491DD1-C41C-4797-A5EB-8523985265BA","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: make hash table per queue\n\nSharing a global hash table among all queues is tempting, but\nit can cause crash:\n\nBUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]\n[..]\n nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue]\n nfnetlink_rcv_msg+0x46a/0x930\n kmem_cache_alloc_node_noprof+0x11e/0x450\n\nstruct nf_queue_entry is freed via kfree, but parallel cpu can still\nencounter such an nf_queue_entry when walking the list.\n\nAlternative fix is to free the nf_queue_entry via kfree_rcu() instead,\nbut as we have to alloc/free for each skb this will cause more mem\npressure."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nfnetlink_queue: hacer tabla hash por cola\n\nCompartir una tabla hash global entre todas las colas es tentador, pero puede causar un fallo:\n\nBUG: KASAN: uso después de liberación de slab en nfqnl_recv_verdict+0x 11ac/0x 15e0 [nfnetlink_queue]\n[..]\n nfqnl_recv_verdict+0x 11ac/0x 15e0 [nfnetlink_queue]\n nfnetlink_rcv_msg+0x46a/0x930\n kmem_cache_alloc_node_noprof+0x11e/0x450\n\nLa estructura nf_queue_entry es liberada vía kfree, pero una CPU paralela aún puede encontrar dicha nf_queue_entry al recorrer la lista.\n\nUna solución alternativa es liberar la nf_queue_entry vía kfree_rcu() en su lugar, pero como tenemos que asignar/liberar para cada skb, esto causará más presión de memoria."}],"id":"CVE-2026-43084","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43084","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:29.678333Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:21.610","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22730cb96093b5be0609063bbb1923dbecd61252"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41e3652a178cb0eecd48e0e6e27fbb73a004046a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/936206e3f6ff411581e615e930263d6f8b78df9d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e5ebef91120d2764aefe557c3a484b6288f341f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43088.json b/data/2026/CVE-2026-43088.json
index c71556d240..a0de273877 100644
--- a/data/2026/CVE-2026-43088.json
+++ b/data/2026/CVE-2026-43088.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6df5f90175fe4c584e9960b6c00131a7bf2b5399","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"746ee79d9e140f0e9e56f5123eaa88ad9332de7b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"e357c3cf8a44d4ec1f49ad6981e4ab9704354347","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"3c19cb8a84ef709d57943bd6664cf31cb91ba6ec","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"11cbf294bac623bd57296f231199193087f57b4a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"edd446ee7cd3d02cac246168063d5b3e9ea68460","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"2e74f974359b5382ecbe8536abbb5b837eb6c724","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.270","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.88","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.30","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F6A976D5-52D2-4887-B410-6D4BFD825BCB","versionEndExcluding":"6.12.88","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B","versionEndExcluding":"6.18.30","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_key: zero aligned sockaddr tail in PF_KEY exports\n\nPF_KEY export paths use `pfkey_sockaddr_size()` when reserving sockaddr\npayload space, so IPv6 addresses occupy 32 bytes on the wire. However,\n`pfkey_sockaddr_fill()` initializes only the first 28 bytes of\n`struct sockaddr_in6`, leaving the final 4 aligned bytes uninitialized.\n\nNot every PF_KEY message is affected. The state and policy dump builders\nalready zero the whole message buffer before filling the sockaddr\npayloads. Keep the fix to the export paths that still append aligned\nsockaddr payloads with plain `skb_put()`:\n\n  - `SADB_ACQUIRE`\n  - `SADB_X_NAT_T_NEW_MAPPING`\n  - `SADB_X_MIGRATE`\n\nFix those paths by clearing only the aligned sockaddr tail after\n`pfkey_sockaddr_fill()`."}],"id":"CVE-2026-43088","lastModified":"2026-11-06T16:18:21.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43088","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:17.546123Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.090","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11cbf294bac623bd57296f231199193087f57b4a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e74f974359b5382ecbe8536abbb5b837eb6c724"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3c19cb8a84ef709d57943bd6664cf31cb91ba6ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/426c355742f02cf743b347d9d7dbdc1bfbfa31ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6df5f90175fe4c584e9960b6c00131a7bf2b5399"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/746ee79d9e140f0e9e56f5123eaa88ad9332de7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e357c3cf8a44d4ec1f49ad6981e4ab9704354347"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edd446ee7cd3d02cac246168063d5b3e9ea68460"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6df5f90175fe4c584e9960b6c00131a7bf2b5399","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"746ee79d9e140f0e9e56f5123eaa88ad9332de7b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"e357c3cf8a44d4ec1f49ad6981e4ab9704354347","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"3c19cb8a84ef709d57943bd6664cf31cb91ba6ec","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"11cbf294bac623bd57296f231199193087f57b4a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"edd446ee7cd3d02cac246168063d5b3e9ea68460","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"2e74f974359b5382ecbe8536abbb5b837eb6c724","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"426c355742f02cf743b347d9d7dbdc1bfbfa31ef","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.270","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.221","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.88","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.30","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F6A976D5-52D2-4887-B410-6D4BFD825BCB","versionEndExcluding":"6.12.88","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B","versionEndExcluding":"6.18.30","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_key: zero aligned sockaddr tail in PF_KEY exports\n\nPF_KEY export paths use `pfkey_sockaddr_size()` when reserving sockaddr\npayload space, so IPv6 addresses occupy 32 bytes on the wire. However,\n`pfkey_sockaddr_fill()` initializes only the first 28 bytes of\n`struct sockaddr_in6`, leaving the final 4 aligned bytes uninitialized.\n\nNot every PF_KEY message is affected. The state and policy dump builders\nalready zero the whole message buffer before filling the sockaddr\npayloads. Keep the fix to the export paths that still append aligned\nsockaddr payloads with plain `skb_put()`:\n\n  - `SADB_ACQUIRE`\n  - `SADB_X_NAT_T_NEW_MAPPING`\n  - `SADB_X_MIGRATE`\n\nFix those paths by clearing only the aligned sockaddr tail after\n`pfkey_sockaddr_fill()`."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: af_key: cola sockaddr alineada a cero en las exportaciones PF_KEY\n\nLas rutas de exportación PF_KEY usan ’pfkey_sockaddr_size()’ al reservar espacio de carga útil sockaddr, por lo que las direcciones IPv6 ocupan 32 bytes en el cable. Sin embargo, ’pfkey_sockaddr_fill()’ inicializa solo los primeros 28 bytes de ’struct sockaddr_in6’, dejando los 4 bytes alineados finales sin inicializar.\n\nNo todos los mensajes PF_KEY se ven afectados. Los constructores de volcado de estado y política ya ponen a cero todo el búfer del mensaje antes de rellenar las cargas útiles sockaddr. Mantener la corrección en las rutas de exportación que aún añaden cargas útiles sockaddr alineadas con ’skb_put()’ simple:\n\n  - ’SADB_ACQUIRE’\n  - ’SADB_X_NAT_T_NEW_MAPPING’\n  - ’SADB_X_MIGRATE’\n\nCorregir esas rutas borrando solo la cola sockaddr alineada después de ’pfkey_sockaddr_fill()’."}],"id":"CVE-2026-43088","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43088","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:17.546123Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.090","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11cbf294bac623bd57296f231199193087f57b4a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e74f974359b5382ecbe8536abbb5b837eb6c724"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3c19cb8a84ef709d57943bd6664cf31cb91ba6ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/426c355742f02cf743b347d9d7dbdc1bfbfa31ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6df5f90175fe4c584e9960b6c00131a7bf2b5399"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/746ee79d9e140f0e9e56f5123eaa88ad9332de7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e357c3cf8a44d4ec1f49ad6981e4ab9704354347"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edd446ee7cd3d02cac246168063d5b3e9ea68460"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43089.json b/data/2026/CVE-2026-43089.json
index cadb8e43f8..3b663ce42c 100644
--- a/data/2026/CVE-2026-43089.json
+++ b/data/2026/CVE-2026-43089.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"521385cbd50ca9474396d88462fcdfa6489685d9","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"c2779ae9a3e5a044e5ccd564681511bbbcc5fc0f","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"72a8de41c3eb4dcf22bf3b674ea38fb2f75d6f32","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"d3125c541a96fb3c0fc7210112684baf22b6c24d","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"5a1a4b049ddde41466ccac0daeec326254b133f2","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"f779a6b6cdb6e12baa0663063ac59ab2a8f20c0c","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"700c9622b23c33b5933e6dcea816492c064e4e10","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"1beb76b2053b68c491b78370794b8ff63c8f8c02","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.29"},{"lessThan":"2.6.29","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1ED513DC-018F-421C-9104-163074DC3151","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.29.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_mapping()\n\nstruct xfrm_usersa_id has a one-byte padding hole after the proto\nfield, which ends up never getting set to zero before copying out to\nuserspace.  Fix that up by zeroing out the whole structure before\nsetting individual variables."}],"id":"CVE-2026-43089","lastModified":"2026-11-10T13:19:11.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43089","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:21.792883Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.200","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1beb76b2053b68c491b78370794b8ff63c8f8c02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/521385cbd50ca9474396d88462fcdfa6489685d9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a1a4b049ddde41466ccac0daeec326254b133f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/700c9622b23c33b5933e6dcea816492c064e4e10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/72a8de41c3eb4dcf22bf3b674ea38fb2f75d6f32"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c2779ae9a3e5a044e5ccd564681511bbbcc5fc0f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3125c541a96fb3c0fc7210112684baf22b6c24d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f779a6b6cdb6e12baa0663063ac59ab2a8f20c0c"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"521385cbd50ca9474396d88462fcdfa6489685d9","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"c2779ae9a3e5a044e5ccd564681511bbbcc5fc0f","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"72a8de41c3eb4dcf22bf3b674ea38fb2f75d6f32","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"d3125c541a96fb3c0fc7210112684baf22b6c24d","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"5a1a4b049ddde41466ccac0daeec326254b133f2","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"f779a6b6cdb6e12baa0663063ac59ab2a8f20c0c","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"700c9622b23c33b5933e6dcea816492c064e4e10","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"},{"lessThan":"1beb76b2053b68c491b78370794b8ff63c8f8c02","status":"affected","version":"3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.29"},{"lessThan":"2.6.29","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1ED513DC-018F-421C-9104-163074DC3151","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.29.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_mapping()\n\nstruct xfrm_usersa_id has a one-byte padding hole after the proto\nfield, which ends up never getting set to zero before copying out to\nuserspace.  Fix that up by zeroing out the whole structure before\nsetting individual variables."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm_user: corrección de fuga de información en build_mapping()\n\nLa estructura xfrm_usersa_id tiene un hueco de relleno de un byte después del campo proto, que nunca se inicializa a cero antes de ser copiado al espacio de usuario. Esto se soluciona inicializando a cero toda la estructura antes de establecer variables individuales."}],"id":"CVE-2026-43089","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43089","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:21.792883Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.200","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1beb76b2053b68c491b78370794b8ff63c8f8c02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/521385cbd50ca9474396d88462fcdfa6489685d9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a1a4b049ddde41466ccac0daeec326254b133f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/700c9622b23c33b5933e6dcea816492c064e4e10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/72a8de41c3eb4dcf22bf3b674ea38fb2f75d6f32"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c2779ae9a3e5a044e5ccd564681511bbbcc5fc0f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3125c541a96fb3c0fc7210112684baf22b6c24d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f779a6b6cdb6e12baa0663063ac59ab2a8f20c0c"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43090.json b/data/2026/CVE-2026-43090.json
index eea34f0b45..ba51f7d446 100644
--- a/data/2026/CVE-2026-43090.json
+++ b/data/2026/CVE-2026-43090.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"21e235a36cfb6d145cefb10728f12f5dc5412f54","status":"affected","version":"563d5ca93e883b9dcb4b7dc8967ac569fd91820d","versionType":"git"},{"lessThan":"836ee1b0426ea3db31531e9581cc32f513d24e32","status":"affected","version":"563d5ca93e883b9dcb4b7dc8967ac569fd91820d","versionType":"git"},{"lessThan":"70c2a89a3bc207c3bfbf6f21bb439809e0a4a27a","status":"affected","version":"563d5ca93e883b9dcb4b7dc8967ac569fd91820d","versionType":"git"},{"lessThan":"83317cce60a032c49480dcdabe146435bd689d03","status":"affected","version":"563d5ca93e883b9dcb4b7dc8967ac569fd91820d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix refcount leak in xfrm_migrate_policy_find\n\nsyzkaller reported a memory leak in xfrm_policy_alloc:\n\n  BUG: memory leak\n  unreferenced object 0xffff888114d79000 (size 1024):\n    comm \"syz.1.17\", pid 931\n    ...\n    xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432\n\nThe root cause is a double call to xfrm_pol_hold_rcu() in\nxfrm_migrate_policy_find(). The lookup function already returns\na policy with held reference, making the second call redundant.\n\nRemove the redundant xfrm_pol_hold_rcu() call to fix the refcount\nimbalance and prevent the memory leak.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."}],"id":"CVE-2026-43090","lastModified":"2026-06-17T10:48:55.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:22.313","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21e235a36cfb6d145cefb10728f12f5dc5412f54"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70c2a89a3bc207c3bfbf6f21bb439809e0a4a27a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83317cce60a032c49480dcdabe146435bd689d03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/836ee1b0426ea3db31531e9581cc32f513d24e32"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"21e235a36cfb6d145cefb10728f12f5dc5412f54","status":"affected","version":"563d5ca93e883b9dcb4b7dc8967ac569fd91820d","versionType":"git"},{"lessThan":"836ee1b0426ea3db31531e9581cc32f513d24e32","status":"affected","version":"563d5ca93e883b9dcb4b7dc8967ac569fd91820d","versionType":"git"},{"lessThan":"70c2a89a3bc207c3bfbf6f21bb439809e0a4a27a","status":"affected","version":"563d5ca93e883b9dcb4b7dc8967ac569fd91820d","versionType":"git"},{"lessThan":"83317cce60a032c49480dcdabe146435bd689d03","status":"affected","version":"563d5ca93e883b9dcb4b7dc8967ac569fd91820d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix refcount leak in xfrm_migrate_policy_find\n\nsyzkaller reported a memory leak in xfrm_policy_alloc:\n\n  BUG: memory leak\n  unreferenced object 0xffff888114d79000 (size 1024):\n    comm \"syz.1.17\", pid 931\n    ...\n    xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432\n\nThe root cause is a double call to xfrm_pol_hold_rcu() in\nxfrm_migrate_policy_find(). The lookup function already returns\na policy with held reference, making the second call redundant.\n\nRemove the redundant xfrm_pol_hold_rcu() call to fix the refcount\nimbalance and prevent the memory leak.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: solucionar fuga de refcount en xfrm_migrate_policy_find\n\nsyzkaller informó una fuga de memoria en xfrm_policy_alloc:\n\n  BUG: fuga de memoria\n  objeto sin referencia 0x ffff888114d79000 (tamaño 1024):\n    comm ’syz.1.17’, pid 931\n    ...\n    xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432\n\nLa causa raíz es una doble llamada a xfrm_pol_hold_rcu() en xfrm_migrate_policy_find(). La función de búsqueda ya devuelve una política con referencia retenida, haciendo que la segunda llamada sea redundante.\n\nEliminar la llamada redundante a xfrm_pol_hold_rcu() para solucionar el desequilibrio de refcount y prevenir la fuga de memoria.\n\nEncontrado por Linux Verification Center (linuxtesting.org) con Syzkaller."}],"id":"CVE-2026-43090","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:22.313","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21e235a36cfb6d145cefb10728f12f5dc5412f54"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70c2a89a3bc207c3bfbf6f21bb439809e0a4a27a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83317cce60a032c49480dcdabe146435bd689d03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/836ee1b0426ea3db31531e9581cc32f513d24e32"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43091.json b/data/2026/CVE-2026-43091.json
index 6b4d1a3e1b..4f48402bf1 100644
--- a/data/2026/CVE-2026-43091.json
+++ b/data/2026/CVE-2026-43091.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b2faee12538b5b008eaef65a4201eb29cb5cefb3","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"b66920a3348c0f63ba18365248fa21fbf0b3a937","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"438b1f668ad58f46ce699bb48e4698a7839e3f9e","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"3733fce2871c9bca9dd18a1a23b1432ea215a094","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"33a3149dd81a1e2f52b80ee1e0fc380b39f3d028","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"069daad4f2ae9c5c108131995529d5f02392c446","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F2AB5131-D1D3-4634-BAD0-DCDA846721A3","versionEndExcluding":"6.6.136","versionStartIncluding":"4.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Wait for RCU readers during policy netns exit\n\nxfrm_policy_fini() frees the policy_bydst hash tables after flushing the\npolicy work items and deleting all policies, but it does not wait for\nconcurrent RCU readers to leave their read-side critical sections first.\n\nThe policy_bydst tables are published via rcu_assign_pointer() and are\nlooked up through rcu_dereference_check(), so netns teardown must also\nwait for an RCU grace period before freeing the table memory.\n\nFix this by adding synchronize_rcu() before freeing the policy hash tables."}],"id":"CVE-2026-43091","lastModified":"2026-10-30T13:18:45.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43091","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:31.928454Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.433","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/069daad4f2ae9c5c108131995529d5f02392c446"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33a3149dd81a1e2f52b80ee1e0fc380b39f3d028"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3733fce2871c9bca9dd18a1a23b1432ea215a094"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/438b1f668ad58f46ce699bb48e4698a7839e3f9e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b2faee12538b5b008eaef65a4201eb29cb5cefb3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b66920a3348c0f63ba18365248fa21fbf0b3a937"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b2faee12538b5b008eaef65a4201eb29cb5cefb3","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"b66920a3348c0f63ba18365248fa21fbf0b3a937","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"438b1f668ad58f46ce699bb48e4698a7839e3f9e","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"3733fce2871c9bca9dd18a1a23b1432ea215a094","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"33a3149dd81a1e2f52b80ee1e0fc380b39f3d028","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"},{"lessThan":"069daad4f2ae9c5c108131995529d5f02392c446","status":"affected","version":"e1e551bc56302b80ff930c966f9985095fb1b70d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F2AB5131-D1D3-4634-BAD0-DCDA846721A3","versionEndExcluding":"6.6.136","versionStartIncluding":"4.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Wait for RCU readers during policy netns exit\n\nxfrm_policy_fini() frees the policy_bydst hash tables after flushing the\npolicy work items and deleting all policies, but it does not wait for\nconcurrent RCU readers to leave their read-side critical sections first.\n\nThe policy_bydst tables are published via rcu_assign_pointer() and are\nlooked up through rcu_dereference_check(), so netns teardown must also\nwait for an RCU grace period before freeing the table memory.\n\nFix this by adding synchronize_rcu() before freeing the policy hash tables."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: Esperar a los lectores RCU durante la salida de netns de política\n\nxfrm_policy_fini() libera las tablas hash policy_bydst después de vaciar los elementos de trabajo de política y eliminar todas las políticas, pero no espera a que los lectores RCU concurrentes salgan primero de sus secciones críticas de lectura.\n\nLas tablas policy_bydst se publican a través de rcu_assign_pointer() y se buscan mediante rcu_dereference_check(), por lo que el desmantelamiento de netns también debe esperar un período de gracia RCU antes de liberar la memoria de la tabla.\n\nEsto se soluciona añadiendo synchronize_rcu() antes de liberar las tablas hash de política."}],"id":"CVE-2026-43091","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43091","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:31.928454Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.433","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/069daad4f2ae9c5c108131995529d5f02392c446"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33a3149dd81a1e2f52b80ee1e0fc380b39f3d028"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3733fce2871c9bca9dd18a1a23b1432ea215a094"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/438b1f668ad58f46ce699bb48e4698a7839e3f9e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b2faee12538b5b008eaef65a4201eb29cb5cefb3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b66920a3348c0f63ba18365248fa21fbf0b3a937"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43092.json b/data/2026/CVE-2026-43092.json
index a2680bec6d..b99af106d4 100644
--- a/data/2026/CVE-2026-43092.json
+++ b/data/2026/CVE-2026-43092.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xdp/xsk_buff_pool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a55793e5a97d4e39bdb380873a9780fe0010bff6","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"},{"lessThan":"f669d60db11dbabb96279f2b20f9d1cba43cddb2","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"},{"lessThan":"25e1e91a8da819924df0b16e3812d7b24c8ce133","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"},{"lessThan":"b2f4daa6422fd6cc0cec969794dab4a88ea4cea1","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"},{"lessThan":"36ee60b569ba0dfb6f961333b90d19ab5b323fa9","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xdp/xsk_buff_pool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D1C8822E-08AF-49C3-8A31-F806E5FAE5E7","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate MTU against usable frame size on bind\n\nAF_XDP bind currently accepts zero-copy pool configurations without\nverifying that the device MTU fits into the usable frame space provided\nby the UMEM chunk.\n\nThis becomes a problem since we started to respect tailroom which is\nsubtracted from chunk_size (among with headroom). 2k chunk size might\nnot provide enough space for standard 1500 MTU, so let us catch such\nsettings at bind time. Furthermore, validate whether underlying HW will\nbe able to satisfy configured MTU wrt XSK's frame size multiplied by\nsupported Rx buffer chain length (that is exposed via\nnet_device::xdp_zc_max_segs)."}],"id":"CVE-2026-43092","lastModified":"2026-06-17T10:48:55.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:22.550","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25e1e91a8da819924df0b16e3812d7b24c8ce133"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36ee60b569ba0dfb6f961333b90d19ab5b323fa9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a55793e5a97d4e39bdb380873a9780fe0010bff6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b2f4daa6422fd6cc0cec969794dab4a88ea4cea1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f669d60db11dbabb96279f2b20f9d1cba43cddb2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xdp/xsk_buff_pool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a55793e5a97d4e39bdb380873a9780fe0010bff6","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"},{"lessThan":"f669d60db11dbabb96279f2b20f9d1cba43cddb2","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"},{"lessThan":"25e1e91a8da819924df0b16e3812d7b24c8ce133","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"},{"lessThan":"b2f4daa6422fd6cc0cec969794dab4a88ea4cea1","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"},{"lessThan":"36ee60b569ba0dfb6f961333b90d19ab5b323fa9","status":"affected","version":"24ea50127ecf0efe819c1f6230add27abc6ca9d9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xdp/xsk_buff_pool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D1C8822E-08AF-49C3-8A31-F806E5FAE5E7","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate MTU against usable frame size on bind\n\nAF_XDP bind currently accepts zero-copy pool configurations without\nverifying that the device MTU fits into the usable frame space provided\nby the UMEM chunk.\n\nThis becomes a problem since we started to respect tailroom which is\nsubtracted from chunk_size (among with headroom). 2k chunk size might\nnot provide enough space for standard 1500 MTU, so let us catch such\nsettings at bind time. Furthermore, validate whether underlying HW will\nbe able to satisfy configured MTU wrt XSK's frame size multiplied by\nsupported Rx buffer chain length (that is exposed via\nnet_device::xdp_zc_max_segs)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxsk: validar MTU contra el tamaño de trama utilizable al enlazar\n\nEl enlace AF_XDP actualmente acepta configuraciones de pool de copia cero sin verificar que la MTU del dispositivo encaja en el espacio de trama utilizable proporcionado por el fragmento UMEM.\n\nEsto se convierte en un problema desde que empezamos a respetar el tailroom que se resta del chunk_size (junto con el headroom). Un tamaño de fragmento de 2k podría no proporcionar suficiente espacio para una MTU estándar de 1500, así que detectemos tales configuraciones en el momento del enlace. Además, validar si el HW subyacente podrá satisfacer la MTU configurada con respecto al tamaño de trama de XSK multiplicado por la longitud de cadena de búfer Rx soportada (que se expone a través de net_device::xdp_zc_max_segs)."}],"id":"CVE-2026-43092","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:22.550","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25e1e91a8da819924df0b16e3812d7b24c8ce133"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36ee60b569ba0dfb6f961333b90d19ab5b323fa9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a55793e5a97d4e39bdb380873a9780fe0010bff6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b2f4daa6422fd6cc0cec969794dab4a88ea4cea1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f669d60db11dbabb96279f2b20f9d1cba43cddb2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43093.json b/data/2026/CVE-2026-43093.json
index 98a1e8a664..0b8876b02c 100644
--- a/data/2026/CVE-2026-43093.json
+++ b/data/2026/CVE-2026-43093.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xdp/xdp_umem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5f123bc278bf4e3283d8606321bebbfd299f4384","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"1a6051cd7e3e4c54ff3854a43b638b9292af5e67","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"8769708add9eadeea8041a9761771bb715a87104","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"a03975beb9f6af0d8ac051e30b2abeabe618414f","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"0ec4d3f6e6934deb843b561ae048cd17218e5ad1","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"6523bc1b40e69301f24c14338b762af4739d6d39","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"a315e022a72d95ef5f1d4e58e903cb492b0ad931","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"status":"affected","version":"ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6ee","versionType":"git"},{"status":"affected","version":"25c9cdef57488578da21d99eb614b97ffcf6e59f","versionType":"git"},{"status":"affected","version":"98d3c852e63b49129515dd18c875999efaf8530a","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.118","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.35","versionType":"semver"},{"lessThan":"5.7","status":"affected","version":"5.6.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xdp/xdp_umem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1D66A78-E0DD-4D66-9446-03DE28F5FE2F","versionEndExcluding":"4.20","versionStartIncluding":"4.19.118","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4ED55BB9-F8CA-4CCD-94DD-BC6F5E60E5D9","versionEndExcluding":"5.5","versionStartIncluding":"5.4.35","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"30A44027-1F59-4AF5-B227-86E61A43A865","versionEndExcluding":"5.7","versionStartIncluding":"5.6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1D0E985F-975A-4107-B163-94D4DCD5FD9B","versionEndExcluding":"6.6.136","versionStartIncluding":"5.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*","matchCriteriaId":"3D23CE42-BDB2-4216-8495-230ABE98FCDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc2:*:*:*:*:*:*","matchCriteriaId":"2AAE09B2-58C0-42B8-ACDA-578904723270","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc3:*:*:*:*:*:*","matchCriteriaId":"59EEFC0E-2E5A-4113-A58D-2EE2CC7CFA3B","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc4:*:*:*:*:*:*","matchCriteriaId":"3CC0A9A2-D528-49AA-AB7F-37C5EA7AB76D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc5:*:*:*:*:*:*","matchCriteriaId":"512FF86F-0B8C-4DEB-9041-8BD384DD2E58","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc6:*:*:*:*:*:*","matchCriteriaId":"F1AB4A11-C03C-4ABB-B596-0EB3B0F1A8DF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc7:*:*:*:*:*:*","matchCriteriaId":"9D26AE9C-D49F-4FE9-8A6A-5A7199B7436E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: tighten UMEM headroom validation to account for tailroom and min frame\n\nThe current headroom validation in xdp_umem_reg() could leave us with\ninsufficient space dedicated to even receive minimum-sized ethernet\nframe. Furthermore if multi-buffer would come to play then\nskb_shared_info stored at the end of XSK frame would be corrupted.\n\nHW typically works with 128-aligned sizes so let us provide this value\nas bare minimum.\n\nMulti-buffer setting is known later in the configuration process so\nbesides accounting for 128 bytes, let us also take care of tailroom space\nupfront."}],"id":"CVE-2026-43093","lastModified":"2026-10-19T20:18:05.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43093","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:34.453140Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.667","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0ec4d3f6e6934deb843b561ae048cd17218e5ad1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1a6051cd7e3e4c54ff3854a43b638b9292af5e67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5f123bc278bf4e3283d8606321bebbfd299f4384"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6523bc1b40e69301f24c14338b762af4739d6d39"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8769708add9eadeea8041a9761771bb715a87104"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a03975beb9f6af0d8ac051e30b2abeabe618414f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a315e022a72d95ef5f1d4e58e903cb492b0ad931"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xdp/xdp_umem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5f123bc278bf4e3283d8606321bebbfd299f4384","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"1a6051cd7e3e4c54ff3854a43b638b9292af5e67","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"8769708add9eadeea8041a9761771bb715a87104","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"a03975beb9f6af0d8ac051e30b2abeabe618414f","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"0ec4d3f6e6934deb843b561ae048cd17218e5ad1","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"6523bc1b40e69301f24c14338b762af4739d6d39","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"lessThan":"a315e022a72d95ef5f1d4e58e903cb492b0ad931","status":"affected","version":"99e3a236dd43d06c65af0a2ef9cb44306aef6e02","versionType":"git"},{"status":"affected","version":"ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6ee","versionType":"git"},{"status":"affected","version":"25c9cdef57488578da21d99eb614b97ffcf6e59f","versionType":"git"},{"status":"affected","version":"98d3c852e63b49129515dd18c875999efaf8530a","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.118","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.35","versionType":"semver"},{"lessThan":"5.7","status":"affected","version":"5.6.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xdp/xdp_umem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1D66A78-E0DD-4D66-9446-03DE28F5FE2F","versionEndExcluding":"4.20","versionStartIncluding":"4.19.118","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4ED55BB9-F8CA-4CCD-94DD-BC6F5E60E5D9","versionEndExcluding":"5.5","versionStartIncluding":"5.4.35","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"30A44027-1F59-4AF5-B227-86E61A43A865","versionEndExcluding":"5.7","versionStartIncluding":"5.6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1D0E985F-975A-4107-B163-94D4DCD5FD9B","versionEndExcluding":"6.6.136","versionStartIncluding":"5.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*","matchCriteriaId":"3D23CE42-BDB2-4216-8495-230ABE98FCDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc2:*:*:*:*:*:*","matchCriteriaId":"2AAE09B2-58C0-42B8-ACDA-578904723270","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc3:*:*:*:*:*:*","matchCriteriaId":"59EEFC0E-2E5A-4113-A58D-2EE2CC7CFA3B","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc4:*:*:*:*:*:*","matchCriteriaId":"3CC0A9A2-D528-49AA-AB7F-37C5EA7AB76D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc5:*:*:*:*:*:*","matchCriteriaId":"512FF86F-0B8C-4DEB-9041-8BD384DD2E58","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc6:*:*:*:*:*:*","matchCriteriaId":"F1AB4A11-C03C-4ABB-B596-0EB3B0F1A8DF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:rc7:*:*:*:*:*:*","matchCriteriaId":"9D26AE9C-D49F-4FE9-8A6A-5A7199B7436E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: tighten UMEM headroom validation to account for tailroom and min frame\n\nThe current headroom validation in xdp_umem_reg() could leave us with\ninsufficient space dedicated to even receive minimum-sized ethernet\nframe. Furthermore if multi-buffer would come to play then\nskb_shared_info stored at the end of XSK frame would be corrupted.\n\nHW typically works with 128-aligned sizes so let us provide this value\nas bare minimum.\n\nMulti-buffer setting is known later in the configuration process so\nbesides accounting for 128 bytes, let us also take care of tailroom space\nupfront."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxsk: ajustar la validación del espacio de cabecera de UMEM para tener en cuenta el espacio de cola y el marco mínimo\n\nLa validación actual del espacio de cabecera en xdp_umem_reg() podría dejarnos con espacio insuficiente dedicado incluso para recibir un marco Ethernet de tamaño mínimo. Además, si el multi-buffer entrara en juego, entonces skb_shared_info almacenado al final del marco XSK se corrompería.\n\nEl hardware típicamente trabaja con tamaños alineados a 128, así que proporcionemos este valor como mínimo indispensable.\n\nLa configuración del multi-buffer se conoce más tarde en el proceso de configuración, así que además de tener en cuenta 128 bytes, ocupémonos también del espacio de cola de antemano."}],"id":"CVE-2026-43093","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43093","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:34.453140Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.667","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0ec4d3f6e6934deb843b561ae048cd17218e5ad1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1a6051cd7e3e4c54ff3854a43b638b9292af5e67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5f123bc278bf4e3283d8606321bebbfd299f4384"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6523bc1b40e69301f24c14338b762af4739d6d39"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8769708add9eadeea8041a9761771bb715a87104"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a03975beb9f6af0d8ac051e30b2abeabe618414f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a315e022a72d95ef5f1d4e58e903cb492b0ad931"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43094.json b/data/2026/CVE-2026-43094.json
index 300875b235..3d8f56977c 100644
--- a/data/2026/CVE-2026-43094.json
+++ b/data/2026/CVE-2026-43094.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/ixgbevf/vf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"376d74ea03589914fbe2dedcbebf418396c04fd0","status":"affected","version":"871ac1cd4ce4804defcb428cbb003fd84c415ff4","versionType":"git"},{"lessThan":"d8a747057a17ffc79e31df1abb11d05e1669d8e5","status":"affected","version":"2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18","versionType":"git"},{"lessThan":"2270ebab53128fb73c4a70a292be09094074737f","status":"affected","version":"bf580112ed61736c2645a893413a04732505d4b1","versionType":"git"},{"lessThan":"4db7b61ec1d1b2b67c0881b62fc4f9583bc21484","status":"affected","version":"a7075f501bd33c93570af759b6f4302ef0175168","versionType":"git"},{"lessThan":"1455ff8809843e6e83f1f5b5c0bcc2224c99a3cb","status":"affected","version":"a7075f501bd33c93570af759b6f4302ef0175168","versionType":"git"},{"lessThan":"4821d563cd7f251ae728be1a6d04af82a294a5b9","status":"affected","version":"a7075f501bd33c93570af759b6f4302ef0175168","versionType":"git"},{"status":"affected","version":"a376e29b1b196dc90b50df7e5e3947e3026300c4","versionType":"git"},{"lessThan":"6.1.175","status":"affected","version":"6.1.158","versionType":"semver"},{"lessThan":"6.6.136","status":"affected","version":"6.6.114","versionType":"semver"},{"lessThan":"6.12.83","status":"affected","version":"6.12.55","versionType":"semver"},{"lessThan":"6.18","status":"affected","version":"6.17.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/ixgbevf/vf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"269CADBB-7B11-43CF-9BF8-954B5BBE3FC9","versionEndExcluding":"6.2","versionStartIncluding":"6.1.158","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3B4693AB-5652-430E-AA6D-D6005BC338E1","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6.114","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BC685D6B-EAAE-4AB3-B934-49C67FD3333D","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12.55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"27929282-2519-484B-B04C-5B62B31FBC5E","versionEndExcluding":"6.18","versionStartIncluding":"6.17.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A96857B3-E61E-41C6-AEFD-BCF93E7D64AC","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*","matchCriteriaId":"A8A65C5A-918F-4E0B-8E98-08A29FFBA58A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*","matchCriteriaId":"26CA425A-E44F-49D2-92D9-1DDD56398440","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*","matchCriteriaId":"BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*","matchCriteriaId":"2545FB83-C4A6-4F62-9ED1-09F75D2E3C78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*","matchCriteriaId":"E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*","matchCriteriaId":"38C4D89F-9A13-4D29-8645-C9785C142C07","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: add missing negotiate_features op to Hyper-V ops table\n\nCommit a7075f501bd3 (\"ixgbevf: fix mailbox API compatibility by\nnegotiating supported features\") added the .negotiate_features callback\nto ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgot\nto add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULL\non Hyper-V VMs.\n\nDuring probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(),\nwhich unconditionally dereferences hw->mac.ops.negotiate_features().\nOn Hyper-V this results in a NULL pointer dereference:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  [...]\n  Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...]\n  Workqueue: events work_for_cpu_fn\n  RIP: 0010:0x0\n  [...]\n  Call Trace:\n   ixgbevf_negotiate_api+0x66/0x160 [ixgbevf]\n   ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf]\n   ixgbevf_probe+0x20f/0x4a0 [ixgbevf]\n   local_pci_probe+0x50/0xa0\n   work_for_cpu_fn+0x1a/0x30\n   [...]\n\nAdd ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and\nwire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP\ngracefully."}],"id":"CVE-2026-43094","lastModified":"2026-11-06T16:18:22.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:26.046237Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.790","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1455ff8809843e6e83f1f5b5c0bcc2224c99a3cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2270ebab53128fb73c4a70a292be09094074737f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/376d74ea03589914fbe2dedcbebf418396c04fd0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4821d563cd7f251ae728be1a6d04af82a294a5b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4db7b61ec1d1b2b67c0881b62fc4f9583bc21484"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8a747057a17ffc79e31df1abb11d05e1669d8e5"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/ixgbevf/vf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"376d74ea03589914fbe2dedcbebf418396c04fd0","status":"affected","version":"871ac1cd4ce4804defcb428cbb003fd84c415ff4","versionType":"git"},{"lessThan":"d8a747057a17ffc79e31df1abb11d05e1669d8e5","status":"affected","version":"2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18","versionType":"git"},{"lessThan":"2270ebab53128fb73c4a70a292be09094074737f","status":"affected","version":"bf580112ed61736c2645a893413a04732505d4b1","versionType":"git"},{"lessThan":"4db7b61ec1d1b2b67c0881b62fc4f9583bc21484","status":"affected","version":"a7075f501bd33c93570af759b6f4302ef0175168","versionType":"git"},{"lessThan":"1455ff8809843e6e83f1f5b5c0bcc2224c99a3cb","status":"affected","version":"a7075f501bd33c93570af759b6f4302ef0175168","versionType":"git"},{"lessThan":"4821d563cd7f251ae728be1a6d04af82a294a5b9","status":"affected","version":"a7075f501bd33c93570af759b6f4302ef0175168","versionType":"git"},{"status":"affected","version":"a376e29b1b196dc90b50df7e5e3947e3026300c4","versionType":"git"},{"lessThan":"6.1.175","status":"affected","version":"6.1.158","versionType":"semver"},{"lessThan":"6.6.136","status":"affected","version":"6.6.114","versionType":"semver"},{"lessThan":"6.12.83","status":"affected","version":"6.12.55","versionType":"semver"},{"lessThan":"6.18","status":"affected","version":"6.17.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/ixgbevf/vf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"269CADBB-7B11-43CF-9BF8-954B5BBE3FC9","versionEndExcluding":"6.2","versionStartIncluding":"6.1.158","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3B4693AB-5652-430E-AA6D-D6005BC338E1","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6.114","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BC685D6B-EAAE-4AB3-B934-49C67FD3333D","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12.55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"27929282-2519-484B-B04C-5B62B31FBC5E","versionEndExcluding":"6.18","versionStartIncluding":"6.17.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A96857B3-E61E-41C6-AEFD-BCF93E7D64AC","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc2:*:*:*:*:*:*","matchCriteriaId":"A8A65C5A-918F-4E0B-8E98-08A29FFBA58A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*","matchCriteriaId":"26CA425A-E44F-49D2-92D9-1DDD56398440","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*","matchCriteriaId":"BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*","matchCriteriaId":"2545FB83-C4A6-4F62-9ED1-09F75D2E3C78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*","matchCriteriaId":"E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*","matchCriteriaId":"38C4D89F-9A13-4D29-8645-C9785C142C07","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: add missing negotiate_features op to Hyper-V ops table\n\nCommit a7075f501bd3 (\"ixgbevf: fix mailbox API compatibility by\nnegotiating supported features\") added the .negotiate_features callback\nto ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgot\nto add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULL\non Hyper-V VMs.\n\nDuring probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(),\nwhich unconditionally dereferences hw->mac.ops.negotiate_features().\nOn Hyper-V this results in a NULL pointer dereference:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  [...]\n  Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...]\n  Workqueue: events work_for_cpu_fn\n  RIP: 0010:0x0\n  [...]\n  Call Trace:\n   ixgbevf_negotiate_api+0x66/0x160 [ixgbevf]\n   ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf]\n   ixgbevf_probe+0x20f/0x4a0 [ixgbevf]\n   local_pci_probe+0x50/0xa0\n   work_for_cpu_fn+0x1a/0x30\n   [...]\n\nAdd ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and\nwire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP\ngracefully."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nixgbevf: añadir la operación negotiate_features faltante a la tabla de operaciones de Hyper-V\n\nEl commit a7075f501bd3 (’ixgbevf: corregir la compatibilidad de la API del buzón negociando las características admitidas’) añadió la devolución de llamada .negotiate_features a ixgbe_mac_operations y la pobló en ixgbevf_mac_ops, pero olvidó añadirla a ixgbevf_hv_mac_ops. Esto deja el puntero de función NULL en máquinas virtuales Hyper-V.\n\nDurante la sonda, ixgbevf_negotiate_api() llama a ixgbevf_set_features(), que desreferencia incondicionalmente hw  ->  mac.ops.negotiate_features(). En Hyper-V esto resulta en una desreferencia de puntero NULL:\n\n  ERROR: desreferencia de puntero NULL del kernel, dirección: 0000000000000000\n  [...]\n  Nombre del hardware: Máquina virtual de Microsoft Corporation/Máquina virtual [...]\n  Cola de trabajo: eventos work_for_cpu_fn\n  RIP: 0010:0x0\n  [...]\n  Traza de llamada:\n   ixgbevf_negotiate_api+0x66/0x160 [ixgbevf]\n   ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf]\n   ixgbevf_probe+0x20f/0x4a0 [ixgbevf]\n   local_pci_probe+0x50/0xa0\n   work_for_cpu_fn+0x1a/0x30\n   [...]\n\nAñadir ixgbevf_hv_negotiate_features_vf() que devuelve -EOPNOTSUPP y conectarla a ixgbevf_hv_mac_ops. El llamador ya maneja -EOPNOTSUPP de forma elegante."}],"id":"CVE-2026-43094","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:26.046237Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.790","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1455ff8809843e6e83f1f5b5c0bcc2224c99a3cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2270ebab53128fb73c4a70a292be09094074737f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/376d74ea03589914fbe2dedcbebf418396c04fd0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4821d563cd7f251ae728be1a6d04af82a294a5b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4db7b61ec1d1b2b67c0881b62fc4f9583bc21484"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8a747057a17ffc79e31df1abb11d05e1669d8e5"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43095.json b/data/2026/CVE-2026-43095.json
index 7ee6ed49c7..136faf0b6d 100644
--- a/data/2026/CVE-2026-43095.json
+++ b/data/2026/CVE-2026-43095.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/sound/sdca_interrupts.h","sound/soc/sdca/sdca_class_function.c","sound/soc/sdca/sdca_interrupts.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b022da127bd9d2217e8f285e643caf5aff6f7f14","status":"affected","version":"b126394d9ec6f9d8322cf392ba23d4a5f96faf5a","versionType":"git"},{"lessThan":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","status":"affected","version":"b126394d9ec6f9d8322cf392ba23d4a5f96faf5a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/sound/sdca_interrupts.h","sound/soc/sdca/sdca_class_function.c","sound/soc/sdca/sdca_interrupts.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"22CB17E9-BDA0-4794-A588-7A955EDB9A83","versionEndExcluding":"6.19.14","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Fix errors in IRQ cleanup\n\nIRQs are enabled through sdca_irq_populate() from component probe\nusing devm_request_threaded_irq(), this however means the IRQs can\npersist if the sound card is torn down. Some of the IRQ handlers\nstore references to the card and the kcontrols which can then\nfail. Some detail of the crash was explained in [1].\n\nGenerally it is not advised to use devm outside of bus probe, so\nthe code is updated to not use devm. The IRQ requests are not moved\nto bus probe time as it makes passing the snd_soc_component into\nthe IRQs very awkward and would the require a second step once the\ncomponent is available, so it is simpler to just register the IRQs\nat this point, even though that necessitates some manual cleanup."}],"id":"CVE-2026-43095","lastModified":"2026-11-06T16:18:22.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43095","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:30.858501Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.913","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b022da127bd9d2217e8f285e643caf5aff6f7f14"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/sound/sdca_interrupts.h","sound/soc/sdca/sdca_class_function.c","sound/soc/sdca/sdca_interrupts.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b022da127bd9d2217e8f285e643caf5aff6f7f14","status":"affected","version":"b126394d9ec6f9d8322cf392ba23d4a5f96faf5a","versionType":"git"},{"lessThan":"4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9","status":"affected","version":"b126394d9ec6f9d8322cf392ba23d4a5f96faf5a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/sound/sdca_interrupts.h","sound/soc/sdca/sdca_class_function.c","sound/soc/sdca/sdca_interrupts.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"22CB17E9-BDA0-4794-A588-7A955EDB9A83","versionEndExcluding":"6.19.14","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Fix errors in IRQ cleanup\n\nIRQs are enabled through sdca_irq_populate() from component probe\nusing devm_request_threaded_irq(), this however means the IRQs can\npersist if the sound card is torn down. Some of the IRQ handlers\nstore references to the card and the kcontrols which can then\nfail. Some detail of the crash was explained in [1].\n\nGenerally it is not advised to use devm outside of bus probe, so\nthe code is updated to not use devm. The IRQ requests are not moved\nto bus probe time as it makes passing the snd_soc_component into\nthe IRQs very awkward and would the require a second step once the\ncomponent is available, so it is simpler to just register the IRQs\nat this point, even though that necessitates some manual cleanup."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nASoC: SDCA: Corrección de errores en la limpieza de IRQ\n\nLas IRQ se habilitan a través de sdca_irq_populate() desde la sonda del componente usando devm_request_threaded_irq(), esto, sin embargo, significa que las IRQ pueden persistir si la tarjeta de sonido se desmonta. Algunos de los manejadores de IRQ almacenan referencias a la tarjeta y a los kcontrols, lo que puede entonces fallar. Algún detalle del fallo fue explicado en [1].\n\nGeneralmente no se aconseja usar devm fuera de la sonda del bus, por lo que el código se actualiza para no usar devm. Las solicitudes de IRQ no se mueven al momento de la sonda del bus, ya que hace que pasar el snd_soc_component a las IRQ sea muy incómodo y requeriría un segundo paso una vez que el componente esté disponible, por lo que es más sencillo simplemente registrar las IRQ en este punto, aunque eso necesite alguna limpieza manual."}],"id":"CVE-2026-43095","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43095","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:30.858501Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:22.913","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e53116437e919c4b9a9d95fb73ae14fe0cfc8f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b022da127bd9d2217e8f285e643caf5aff6f7f14"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43096.json b/data/2026/CVE-2026-43096.json
index 9bc39d6306..7348556f88 100644
--- a/data/2026/CVE-2026-43096.json
+++ b/data/2026/CVE-2026-43096.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hv/mshv_root_main.c","include/hyperv/hvgdk_mini.h","include/hyperv/hvhdk.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"02226839079ccc558820a3b25c4c46812927b4ba","status":"affected","version":"b9a66cd5ccbb9fade15d0e427e19470d8ad35b75","versionType":"git"},{"lessThan":"16cbec24897624051b324aa3a85859c38ca65fde","status":"affected","version":"b9a66cd5ccbb9fade15d0e427e19470d8ad35b75","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hv/mshv_root_main.c","include/hyperv/hvgdk_mini.h","include/hyperv/hvhdk.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix infinite fault loop on permission-denied GPA intercepts\n\nPrevent infinite fault loops when guests access memory regions without\nproper permissions. Currently, mshv_handle_gpa_intercept() attempts to\nremap pages for all faults on movable memory regions, regardless of\nwhether the access type is permitted. When a guest writes to a read-only\nregion, the remap succeeds but the region remains read-only, causing\nimmediate re-fault and spinning the vCPU indefinitely.\n\nValidate intercept access type against region permissions before\nattempting remaps. Reject writes to non-writable regions and executes to\nnon-executable regions early, returning false to let the VMM handle the\nintercept appropriately.\n\nThis also closes a potential DoS vector where malicious guests could\nintentionally trigger these fault loops to consume host resources."}],"id":"CVE-2026-43096","lastModified":"2026-06-17T10:48:55.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.027","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02226839079ccc558820a3b25c4c46812927b4ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16cbec24897624051b324aa3a85859c38ca65fde"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hv/mshv_root_main.c","include/hyperv/hvgdk_mini.h","include/hyperv/hvhdk.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"02226839079ccc558820a3b25c4c46812927b4ba","status":"affected","version":"b9a66cd5ccbb9fade15d0e427e19470d8ad35b75","versionType":"git"},{"lessThan":"16cbec24897624051b324aa3a85859c38ca65fde","status":"affected","version":"b9a66cd5ccbb9fade15d0e427e19470d8ad35b75","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hv/mshv_root_main.c","include/hyperv/hvgdk_mini.h","include/hyperv/hvhdk.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmshv: Fix infinite fault loop on permission-denied GPA intercepts\n\nPrevent infinite fault loops when guests access memory regions without\nproper permissions. Currently, mshv_handle_gpa_intercept() attempts to\nremap pages for all faults on movable memory regions, regardless of\nwhether the access type is permitted. When a guest writes to a read-only\nregion, the remap succeeds but the region remains read-only, causing\nimmediate re-fault and spinning the vCPU indefinitely.\n\nValidate intercept access type against region permissions before\nattempting remaps. Reject writes to non-writable regions and executes to\nnon-executable regions early, returning false to let the VMM handle the\nintercept appropriately.\n\nThis also closes a potential DoS vector where malicious guests could\nintentionally trigger these fault loops to consume host resources."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmshv: Soluciona el bucle de fallo infinito en intercepciones GPA con permisos denegados\n\nEvita los bucles de fallo infinitos cuando los invitados acceden a regiones de memoria sin los permisos adecuados. Actualmente, mshv_handle_gpa_intercept() intenta remapear páginas para todos los fallos en regiones de memoria movibles, independientemente de si el tipo de acceso está permitido. Cuando un invitado escribe en una región de solo lectura, el remapeo tiene éxito, pero la región permanece de solo lectura, causando un nuevo fallo inmediato y manteniendo la vCPU en un bucle indefinido.\n\nValida el tipo de acceso de intercepción contra los permisos de la región antes de intentar los remapeos. Rechaza las escrituras a regiones no escribibles y las ejecuciones a regiones no ejecutables de forma temprana, devolviendo falso para permitir que el VMM maneje la intercepción de forma adecuada.\n\nEsto también cierra un posible vector de DoS donde invitados maliciosos podrían desencadenar intencionalmente estos bucles de fallo para consumir recursos del host."}],"id":"CVE-2026-43096","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.027","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02226839079ccc558820a3b25c4c46812927b4ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16cbec24897624051b324aa3a85859c38ca65fde"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43097.json b/data/2026/CVE-2026-43097.json
index bba84e16cd..d4f56e37ef 100644
--- a/data/2026/CVE-2026-43097.json
+++ b/data/2026/CVE-2026-43097.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/controller/pci-hyperv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"21bc8e0ba5c2a081b0a2808c976d4c9dbddf1e48","status":"affected","version":"bcce8c74f1ce1e2731ac0261287897e3768767d8","versionType":"git"},{"lessThan":"b6422dff0e518245019233432b6bccfc30b73e2f","status":"affected","version":"bcce8c74f1ce1e2731ac0261287897e3768767d8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/controller/pci-hyperv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: hv: Fix double ida_free in hv_pci_probe error path\n\nIf hv_pci_probe() fails after storing the domain number in\nhbus->bridge->domain_nr, there is a call to free this domain_nr via\npci_bus_release_emul_domain_nr(), however, during cleanup, the bridge\nrelease callback pci_release_host_bridge_dev() also frees the domain_nr\ncausing ida_free to be called on same ID twice and triggering following\nwarning:\n\n  ida_free called for id=28971 which is not allocated.\n  WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198\n  Call Trace:\n   pci_bus_release_emul_domain_nr+0x17/0x20\n   pci_release_host_bridge_dev+0x4b/0x60\n   device_release+0x3b/0xa0\n   kobject_put+0x8e/0x220\n   devm_pci_alloc_host_bridge_release+0xe/0x20\n   devres_release_all+0x9a/0xd0\n   device_unbind_cleanup+0x12/0xa0\n   really_probe+0x1c5/0x3f0\n   vmbus_add_channel_work+0x135/0x1a0\n\nFix this by letting pci core handle the free domain_nr and remove\nthe explicit free called in pci-hyperv driver."}],"id":"CVE-2026-43097","lastModified":"2026-06-17T10:48:55.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.137","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21bc8e0ba5c2a081b0a2808c976d4c9dbddf1e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6422dff0e518245019233432b6bccfc30b73e2f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/controller/pci-hyperv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"21bc8e0ba5c2a081b0a2808c976d4c9dbddf1e48","status":"affected","version":"bcce8c74f1ce1e2731ac0261287897e3768767d8","versionType":"git"},{"lessThan":"b6422dff0e518245019233432b6bccfc30b73e2f","status":"affected","version":"bcce8c74f1ce1e2731ac0261287897e3768767d8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/controller/pci-hyperv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: hv: Fix double ida_free in hv_pci_probe error path\n\nIf hv_pci_probe() fails after storing the domain number in\nhbus->bridge->domain_nr, there is a call to free this domain_nr via\npci_bus_release_emul_domain_nr(), however, during cleanup, the bridge\nrelease callback pci_release_host_bridge_dev() also frees the domain_nr\ncausing ida_free to be called on same ID twice and triggering following\nwarning:\n\n  ida_free called for id=28971 which is not allocated.\n  WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198\n  Call Trace:\n   pci_bus_release_emul_domain_nr+0x17/0x20\n   pci_release_host_bridge_dev+0x4b/0x60\n   device_release+0x3b/0xa0\n   kobject_put+0x8e/0x220\n   devm_pci_alloc_host_bridge_release+0xe/0x20\n   devres_release_all+0x9a/0xd0\n   device_unbind_cleanup+0x12/0xa0\n   really_probe+0x1c5/0x3f0\n   vmbus_add_channel_work+0x135/0x1a0\n\nFix this by letting pci core handle the free domain_nr and remove\nthe explicit free called in pci-hyperv driver."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPCI: hv: Corrige doble ida_free en la ruta de error de hv_pci_probe\n\nSi hv_pci_probe() falla después de almacenar el número de dominio en hbus  ->  bridge  ->  domain_nr, hay una llamada para liberar este domain_nr a través de pci_bus_release_emul_domain_nr(), sin embargo, durante la limpieza, la devolución de llamada de liberación del puente pci_release_host_bridge_dev() también libera el domain_nr causando que ida_free sea llamado en el mismo ID dos veces y activando la siguiente advertencia:\n\n  ida_free called for id=28971 which is not allocated.\n  WARNING: lib/idr.c:594 at ida_free+0xdf/0x160, CPU#0: kworker/0:2/198\n  Call Trace:\n   pci_bus_release_emul_domain_nr+0x17/0x20\n   pci_release_host_bridge_dev+0x4b/0x60\n   device_release+0x3b/0xa0\n   kobject_put+0x8e/0x220\n   devm_pci_alloc_host_bridge_release+0xe/0x20\n   devres_release_all+0x9a/0xd0\n   device_unbind_cleanup+0x12/0xa0\n   really_probe+0x1c5/0x3f0\n   vmbus_add_channel_work+0x135/0x1a0\n\nSoluciona esto dejando que el núcleo PCI maneje la liberación de domain_nr y eliminando la liberación explícita llamada en el controlador pci-hyperv."}],"id":"CVE-2026-43097","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.137","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21bc8e0ba5c2a081b0a2808c976d4c9dbddf1e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6422dff0e518245019233432b6bccfc30b73e2f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43098.json b/data/2026/CVE-2026-43098.json
index e56b378d4b..b2b1c885d6 100644
--- a/data/2026/CVE-2026-43098.json
+++ b/data/2026/CVE-2026-43098.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nfc/s3fwrn5/uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"20a57de2e79b797ed75382659d52bf4c7d9cb446","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"e4ab0fd1c91882f2a7846b1817781c8741f7f315","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"7c31f7a599cf00fad3c204092a91a924126c67e4","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"6d931680a9851481c3243689488eafed08eeff71","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"09822d3d6f68a0cdc4626e0c507324a4927f55a9","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"5c14a19d5b1645cce1cb1252833d70b23635b632","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nfc/s3fwrn5/uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.11"},{"lessThan":"5.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"40B9BA4F-676E-4F69-BF6A-3BF9DAF97D80","versionEndExcluding":"6.6.136","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: s3fwrn5: allocate rx skb before consuming bytes\n\ns3fwrn82_uart_read() reports the number of accepted bytes to the serdev\ncore. The current code consumes bytes into recv_skb and may already\ndeliver a complete frame before allocating a fresh receive buffer.\n\nIf that alloc_skb() fails, the callback returns 0 even though it has\nalready consumed bytes, and it leaves recv_skb as NULL for the next\nreceive callback. That breaks the receive_buf() accounting contract and\ncan also lead to a NULL dereference on the next skb_put_u8().\n\nAllocate the receive skb lazily before consuming the next byte instead.\nIf allocation fails, return the number of bytes already accepted."}],"id":"CVE-2026-43098","lastModified":"2026-06-17T10:48:55.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.250","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09822d3d6f68a0cdc4626e0c507324a4927f55a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20a57de2e79b797ed75382659d52bf4c7d9cb446"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c14a19d5b1645cce1cb1252833d70b23635b632"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d931680a9851481c3243689488eafed08eeff71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7c31f7a599cf00fad3c204092a91a924126c67e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e4ab0fd1c91882f2a7846b1817781c8741f7f315"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nfc/s3fwrn5/uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"20a57de2e79b797ed75382659d52bf4c7d9cb446","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"e4ab0fd1c91882f2a7846b1817781c8741f7f315","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"7c31f7a599cf00fad3c204092a91a924126c67e4","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"6d931680a9851481c3243689488eafed08eeff71","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"09822d3d6f68a0cdc4626e0c507324a4927f55a9","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"},{"lessThan":"5c14a19d5b1645cce1cb1252833d70b23635b632","status":"affected","version":"3f52c2cb7e3ada37513dabb69a22cf917dba754f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nfc/s3fwrn5/uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.11"},{"lessThan":"5.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"40B9BA4F-676E-4F69-BF6A-3BF9DAF97D80","versionEndExcluding":"6.6.136","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: s3fwrn5: allocate rx skb before consuming bytes\n\ns3fwrn82_uart_read() reports the number of accepted bytes to the serdev\ncore. The current code consumes bytes into recv_skb and may already\ndeliver a complete frame before allocating a fresh receive buffer.\n\nIf that alloc_skb() fails, the callback returns 0 even though it has\nalready consumed bytes, and it leaves recv_skb as NULL for the next\nreceive callback. That breaks the receive_buf() accounting contract and\ncan also lead to a NULL dereference on the next skb_put_u8().\n\nAllocate the receive skb lazily before consuming the next byte instead.\nIf allocation fails, return the number of bytes already accepted."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnfc: s3fwrn5: asignar rx skb antes de consumir bytes\n\ns3fwrn82_uart_read() informa el número de bytes aceptados al núcleo de serdev. El código actual consume bytes en recv_skb y puede ya entregar una trama completa antes de asignar un nuevo búfer de recepción.\n\nSi ese alloc_skb() falla, la devolución de llamada devuelve 0 aunque ya haya consumido bytes, y deja recv_skb como NULL para la siguiente devolución de llamada de recepción. Eso rompe el contrato de contabilidad de receive_buf() y también puede llevar a una desreferencia de NULL en el siguiente skb_put_u8().\n\nAsignar el skb de recepción de forma perezosa en su lugar, antes de consumir el siguiente byte. Si la asignación falla, devolver el número de bytes ya aceptados."}],"id":"CVE-2026-43098","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.250","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09822d3d6f68a0cdc4626e0c507324a4927f55a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20a57de2e79b797ed75382659d52bf4c7d9cb446"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c14a19d5b1645cce1cb1252833d70b23635b632"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d931680a9851481c3243689488eafed08eeff71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7c31f7a599cf00fad3c204092a91a924126c67e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e4ab0fd1c91882f2a7846b1817781c8741f7f315"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43099.json b/data/2026/CVE-2026-43099.json
index d3a0c59763..6f470630d9 100644
--- a/data/2026/CVE-2026-43099.json
+++ b/data/2026/CVE-2026-43099.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/icmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f21bc261e60f0c696c58841c4873ff77ed83673","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"dc5db4db19766a61ad65d81d1f55b1c1e51ba78d","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"47a8bf52156ac7e7a581eca31c1f964ba4258d4d","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"6be325206850a0891896d38bcf83a09d8b54ec48","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"f91b3ed9e7fa82a70511b5f6901c88379acf2964","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"5b9911582d441f72fe6ccb15ffe3303bbc07f6f5","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"fde29fd9349327acc50d19a0b5f3d5a6c964dfd8","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/icmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1CA556B4-5EB8-4B96-AEEA-6BDC9CC8BF90","versionEndExcluding":"6.6.136","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: fix null-ptr-deref in icmp_build_probe()\n\nipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the\nIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing\nthis error pointer to dev_hold() will cause a kernel crash with\nnull-ptr-deref.\n\nInstead, silently discard the request. RFC 8335 does not appear to\ndefine a specific response for the case where an IPv6 interface\nidentifier is syntactically valid but the implementation cannot perform\nthe lookup at runtime, and silently dropping the request may safer than\nmisreporting \"No Such Interface\"."}],"id":"CVE-2026-43099","lastModified":"2026-10-15T02:19:30.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:23.400","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f21bc261e60f0c696c58841c4873ff77ed83673"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/47a8bf52156ac7e7a581eca31c1f964ba4258d4d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5b9911582d441f72fe6ccb15ffe3303bbc07f6f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6be325206850a0891896d38bcf83a09d8b54ec48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dc5db4db19766a61ad65d81d1f55b1c1e51ba78d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f91b3ed9e7fa82a70511b5f6901c88379acf2964"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fde29fd9349327acc50d19a0b5f3d5a6c964dfd8"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/icmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f21bc261e60f0c696c58841c4873ff77ed83673","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"dc5db4db19766a61ad65d81d1f55b1c1e51ba78d","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"47a8bf52156ac7e7a581eca31c1f964ba4258d4d","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"6be325206850a0891896d38bcf83a09d8b54ec48","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"f91b3ed9e7fa82a70511b5f6901c88379acf2964","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"5b9911582d441f72fe6ccb15ffe3303bbc07f6f5","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"},{"lessThan":"fde29fd9349327acc50d19a0b5f3d5a6c964dfd8","status":"affected","version":"d329ea5bd8845f0b196bf41b18b6173340d6e0e4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/icmp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1CA556B4-5EB8-4B96-AEEA-6BDC9CC8BF90","versionEndExcluding":"6.6.136","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: fix null-ptr-deref in icmp_build_probe()\n\nipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the\nIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing\nthis error pointer to dev_hold() will cause a kernel crash with\nnull-ptr-deref.\n\nInstead, silently discard the request. RFC 8335 does not appear to\ndefine a specific response for the case where an IPv6 interface\nidentifier is syntactically valid but the implementation cannot perform\nthe lookup at runtime, and silently dropping the request may safer than\nmisreporting \"No Such Interface\"."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipv4: icmp: corrección de desreferencia de puntero nulo en icmp_build_probe()\n\nipv6_stub  ->  ipv6_dev_find() puede devolver ERR_PTR(-EAFNOSUPPORT) cuando la pila IPv6 no está activa (CONFIG_IPV6=m y no cargada), y pasar este puntero de error a dev_hold() causará un fallo del kernel con desreferencia de puntero nulo.\n\nEn su lugar, descartar silenciosamente la solicitud. RFC 8335 no parece definir una respuesta específica para el caso en que un identificador de interfaz IPv6 es sintácticamente válido pero la implementación no puede realizar la búsqueda en tiempo de ejecución, y descartar silenciosamente la solicitud puede ser más seguro que informar erróneamente ’No Such Interface’."}],"id":"CVE-2026-43099","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:23.400","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f21bc261e60f0c696c58841c4873ff77ed83673"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/47a8bf52156ac7e7a581eca31c1f964ba4258d4d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5b9911582d441f72fe6ccb15ffe3303bbc07f6f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6be325206850a0891896d38bcf83a09d8b54ec48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dc5db4db19766a61ad65d81d1f55b1c1e51ba78d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f91b3ed9e7fa82a70511b5f6901c88379acf2964"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fde29fd9349327acc50d19a0b5f3d5a6c964dfd8"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43100.json b/data/2026/CVE-2026-43100.json
index 0e33250771..b062ee5f88 100644
--- a/data/2026/CVE-2026-43100.json
+++ b/data/2026/CVE-2026-43100.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bridge/br_fdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fb612d436ff0317659e45a91c25fd7d9516f5b1b","status":"affected","version":"21446c06b441b9c993870efae71aef4e9aa72ec7","versionType":"git"},{"lessThan":"ddf0ec2d600e7dad62b89692749534d7900a732a","status":"affected","version":"21446c06b441b9c993870efae71aef4e9aa72ec7","versionType":"git"},{"lessThan":"1979645e1842cb7017525a61a0e0e0beb924d02a","status":"affected","version":"21446c06b441b9c993870efae71aef4e9aa72ec7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bridge/br_fdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: guard local VLAN-0 FDB helpers against NULL vlan group\n\nWhen CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and\nnbp_vlan_group() return NULL (br_private.h stub definitions). The\nBR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and\nreaches br_fdb_delete_locals_per_vlan_port() and\nbr_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer\nis dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).\n\nThe observed crash is in the delete path, triggered when creating a\nbridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0\nvia RTM_NEWLINK. The insert helper has the same bug pattern.\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]\n  RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310\n  Call Trace:\n   br_fdb_toggle_local_vlan_0+0x452/0x4c0\n   br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276\n   br_boolopt_toggle net/bridge/br.c:313\n   br_boolopt_multi_toggle net/bridge/br.c:364\n   br_changelink net/bridge/br_netlink.c:1542\n   br_dev_newlink net/bridge/br_netlink.c:1575\n\nAdd NULL checks for the vlan group pointer in both helpers, returning\nearly when there are no VLANs to iterate. This matches the existing\npattern used by other bridge FDB functions such as br_fdb_add() and\nbr_fdb_delete()."}],"id":"CVE-2026-43100","lastModified":"2026-06-17T10:48:56.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.523","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1979645e1842cb7017525a61a0e0e0beb924d02a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ddf0ec2d600e7dad62b89692749534d7900a732a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb612d436ff0317659e45a91c25fd7d9516f5b1b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bridge/br_fdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fb612d436ff0317659e45a91c25fd7d9516f5b1b","status":"affected","version":"21446c06b441b9c993870efae71aef4e9aa72ec7","versionType":"git"},{"lessThan":"ddf0ec2d600e7dad62b89692749534d7900a732a","status":"affected","version":"21446c06b441b9c993870efae71aef4e9aa72ec7","versionType":"git"},{"lessThan":"1979645e1842cb7017525a61a0e0e0beb924d02a","status":"affected","version":"21446c06b441b9c993870efae71aef4e9aa72ec7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bridge/br_fdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: guard local VLAN-0 FDB helpers against NULL vlan group\n\nWhen CONFIG_BRIDGE_VLAN_FILTERING is not set, br_vlan_group() and\nnbp_vlan_group() return NULL (br_private.h stub definitions). The\nBR_BOOLOPT_FDB_LOCAL_VLAN_0 toggle code is compiled unconditionally and\nreaches br_fdb_delete_locals_per_vlan_port() and\nbr_fdb_insert_locals_per_vlan_port(), where the NULL vlan group pointer\nis dereferenced via list_for_each_entry(v, &vg->vlan_list, vlist).\n\nThe observed crash is in the delete path, triggered when creating a\nbridge with IFLA_BR_MULTI_BOOLOPT containing BR_BOOLOPT_FDB_LOCAL_VLAN_0\nvia RTM_NEWLINK. The insert helper has the same bug pattern.\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000056: 0000 [#1] KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x00000000000002b0-0x00000000000002b7]\n  RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310\n  Call Trace:\n   br_fdb_toggle_local_vlan_0+0x452/0x4c0\n   br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276\n   br_boolopt_toggle net/bridge/br.c:313\n   br_boolopt_multi_toggle net/bridge/br.c:364\n   br_changelink net/bridge/br_netlink.c:1542\n   br_dev_newlink net/bridge/br_netlink.c:1575\n\nAdd NULL checks for the vlan group pointer in both helpers, returning\nearly when there are no VLANs to iterate. This matches the existing\npattern used by other bridge FDB functions such as br_fdb_add() and\nbr_fdb_delete()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbridge: proteger los ayudantes FDB locales de VLAN-0 contra el grupo VLAN NULL\n\nCuando CONFIG_BRIDGE_VLAN_FILTERING no está configurado, br_vlan_group() y nbp_vlan_group() devuelven NULL (definiciones de stub de br_private.h). El código de alternancia BR_BOOLOPT_FDB_LOCAL_VLAN_0 se compila incondicionalmente y alcanza br_fdb_delete_locals_per_vlan_port() y br_fdb_insert_locals_per_vlan_port(), donde el puntero de grupo VLAN NULL es desreferenciado a través de list_for_each_entry(v, &vg  ->  vlan_list, vlist).\n\nEl fallo observado está en la ruta de eliminación, activado al crear un bridge con IFLA_BR_MULTI_BOOLOPT que contiene BR_BOOLOPT_FDB_LOCAL_VLAN_0 a través de RTM_NEWLINK. El ayudante de inserción tiene el mismo patrón de error.\n\n  Oops: fallo de protección general, probablemente para dirección no canónica 0x dffffc0000000056: 0000 [#1] KASAN NOPTI\n  KASAN: desreferencia de puntero nulo en el rango [0x 00000000000002b0-0x 00000000000002b7]\n  RIP: 0010:br_fdb_delete_locals_per_vlan+0x2b9/0x310\n  Traza de Llamada:\n   br_fdb_toggle_local_vlan_0+0x452/0x4c0\n   br_toggle_fdb_local_vlan_0+0x31/0x80 net/bridge/br.c:276\n   br_boolopt_toggle net/bridge/br.c:313\n   br_boolopt_multi_toggle net/bridge/br.c:364\n   br_changelink net/bridge/br_netlink.c:1542\n   br_dev_newlink net/bridge/br_netlink.c:1575\n\nAñadir comprobaciones de NULL para el puntero de grupo VLAN en ambos ayudantes, regresando temprano cuando no hay VLANs para iterar. Esto coincide con el patrón existente utilizado por otras funciones FDB de bridge como br_fdb_add() y br_fdb_delete()."}],"id":"CVE-2026-43100","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.523","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1979645e1842cb7017525a61a0e0e0beb924d02a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ddf0ec2d600e7dad62b89692749534d7900a732a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb612d436ff0317659e45a91c25fd7d9516f5b1b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43101.json b/data/2026/CVE-2026-43101.json
index 6648ea7466..a9819e6757 100644
--- a/data/2026/CVE-2026-43101.json
+++ b/data/2026/CVE-2026-43101.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/ioam6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dd0d2827b3643ff307c766865f8e31eab5cbd1f5","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"34b8390ac0ba57004b90ea568ac06f50bf896a80","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"f87aa5d1a7f56727a768757613a303b4245444a1","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"4198aab6f000b4febb18ea820fea20634dd789c7","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"3719c234fa94c37c955b1ecd3742ef280ec135e6","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"4e65a8b8daa18d63255ec58964dd192c7fdd9f8b","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/ioam6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"802EA115-7C28-4222-914F-60C63F721E7D","versionEndExcluding":"6.18.24","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()\n\nWe need to check __in6_dev_get() for possible NULL value, as\nsuggested by Yiming Qian.\n\nAlso add skb_dst_dev_rcu() instead of skb_dst_dev(),\nand two missing READ_ONCE().\n\nNote that @dev can't be NULL."}],"id":"CVE-2026-43101","lastModified":"2026-10-30T13:18:45.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:23.637","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/34b8390ac0ba57004b90ea568ac06f50bf896a80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3719c234fa94c37c955b1ecd3742ef280ec135e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4198aab6f000b4febb18ea820fea20634dd789c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e65a8b8daa18d63255ec58964dd192c7fdd9f8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dd0d2827b3643ff307c766865f8e31eab5cbd1f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f87aa5d1a7f56727a768757613a303b4245444a1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/ioam6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dd0d2827b3643ff307c766865f8e31eab5cbd1f5","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"34b8390ac0ba57004b90ea568ac06f50bf896a80","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"f87aa5d1a7f56727a768757613a303b4245444a1","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"4198aab6f000b4febb18ea820fea20634dd789c7","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"3719c234fa94c37c955b1ecd3742ef280ec135e6","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"},{"lessThan":"4e65a8b8daa18d63255ec58964dd192c7fdd9f8b","status":"affected","version":"9ee11f0fff205b4b3df9750bff5e94f97c71b6a0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/ioam6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"802EA115-7C28-4222-914F-60C63F721E7D","versionEndExcluding":"6.18.24","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()\n\nWe need to check __in6_dev_get() for possible NULL value, as\nsuggested by Yiming Qian.\n\nAlso add skb_dst_dev_rcu() instead of skb_dst_dev(),\nand two missing READ_ONCE().\n\nNote that @dev can't be NULL."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipv6: ioam: solucionar posibles desreferencias NULL en __ioam6_fill_trace_data()\n\nNecesitamos verificar __in6_dev_get() para un posible valor NULL, como sugirió Yiming Qian.\n\nTambién añadir skb_dst_dev_rcu() en lugar de skb_dst_dev(), y dos READ_ONCE() faltantes.\n\nTenga en cuenta que @dev no puede ser NULL."}],"id":"CVE-2026-43101","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:23.637","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/34b8390ac0ba57004b90ea568ac06f50bf896a80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3719c234fa94c37c955b1ecd3742ef280ec135e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4198aab6f000b4febb18ea820fea20634dd789c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e65a8b8daa18d63255ec58964dd192c7fdd9f8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dd0d2827b3643ff307c766865f8e31eab5cbd1f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f87aa5d1a7f56727a768757613a303b4245444a1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43102.json b/data/2026/CVE-2026-43102.json
index 600465cce5..23680bea5d 100644
--- a/data/2026/CVE-2026-43102.json
+++ b/data/2026/CVE-2026-43102.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/airoha/airoha_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4429b761874fb9c7767d12d98913a467ef2654f1","status":"affected","version":"d6d2b0e1538d5c381ec0ca95afaf772c096ea5dc","versionType":"git"},{"lessThan":"7ee0063fbab8aea8f4e4e3165f541bf898b77b80","status":"affected","version":"d6d2b0e1538d5c381ec0ca95afaf772c096ea5dc","versionType":"git"},{"lessThan":"285fa6b1e03cff78ead0383e1b259c44b95faf90","status":"affected","version":"d6d2b0e1538d5c381ec0ca95afaf772c096ea5dc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/airoha/airoha_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"050491AB-682C-426A-A38E-B956530C4C20","versionEndExcluding":"6.18.24","versionStartIncluding":"6.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*","matchCriteriaId":"A1ECC65A-EE37-4479-8E99-4BB68A22A31F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix memory leak in airoha_qdma_rx_process()\n\nIf an error occurs on the subsequents buffers belonging to the\nnon-linear part of the skb (e.g. due to an error in the payload length\nreported by the NIC or if we consumed all the available fragments for\nthe skb), the page_pool fragment will not be linked to the skb so it will\nnot return to the pool in the airoha_qdma_rx_process() error path. Fix the\nmemory leak partially reverting commit 'd6d2b0e1538d (\"net: airoha: Fix\npage recycling in airoha_qdma_rx_process()\")' and always running\npage_pool_put_full_page routine in the airoha_qdma_rx_process() error\npath."}],"id":"CVE-2026-43102","lastModified":"2026-06-17T10:48:56.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.750","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/285fa6b1e03cff78ead0383e1b259c44b95faf90"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4429b761874fb9c7767d12d98913a467ef2654f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ee0063fbab8aea8f4e4e3165f541bf898b77b80"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/airoha/airoha_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4429b761874fb9c7767d12d98913a467ef2654f1","status":"affected","version":"d6d2b0e1538d5c381ec0ca95afaf772c096ea5dc","versionType":"git"},{"lessThan":"7ee0063fbab8aea8f4e4e3165f541bf898b77b80","status":"affected","version":"d6d2b0e1538d5c381ec0ca95afaf772c096ea5dc","versionType":"git"},{"lessThan":"285fa6b1e03cff78ead0383e1b259c44b95faf90","status":"affected","version":"d6d2b0e1538d5c381ec0ca95afaf772c096ea5dc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/airoha/airoha_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"050491AB-682C-426A-A38E-B956530C4C20","versionEndExcluding":"6.18.24","versionStartIncluding":"6.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*","matchCriteriaId":"A1ECC65A-EE37-4479-8E99-4BB68A22A31F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: Fix memory leak in airoha_qdma_rx_process()\n\nIf an error occurs on the subsequents buffers belonging to the\nnon-linear part of the skb (e.g. due to an error in the payload length\nreported by the NIC or if we consumed all the available fragments for\nthe skb), the page_pool fragment will not be linked to the skb so it will\nnot return to the pool in the airoha_qdma_rx_process() error path. Fix the\nmemory leak partially reverting commit 'd6d2b0e1538d (\"net: airoha: Fix\npage recycling in airoha_qdma_rx_process()\")' and always running\npage_pool_put_full_page routine in the airoha_qdma_rx_process() error\npath."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: airoha: Corrección de fuga de memoria en airoha_qdma_rx_process()\n\nSi ocurre un error en los búferes subsiguientes pertenecientes a la parte no lineal del skb (p. ej., debido a un error en la longitud de la carga útil informada por la NIC o si consumimos todos los fragmentos disponibles para el skb), el fragmento de page_pool no se vinculará al skb, por lo que no regresará al pool en la ruta de error de airoha_qdma_rx_process(). Se corrige la fuga de memoria revirtiendo parcialmente el commit ’d6d2b0e1538d (’net: airoha: Fix page recycling in airoha_qdma_rx_process()’)’ y ejecutando siempre la rutina page_pool_put_full_page en la ruta de error de airoha_qdma_rx_process()."}],"id":"CVE-2026-43102","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.750","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/285fa6b1e03cff78ead0383e1b259c44b95faf90"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4429b761874fb9c7767d12d98913a467ef2654f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ee0063fbab8aea8f4e4e3165f541bf898b77b80"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43103.json b/data/2026/CVE-2026-43103.json
index 7be678f7de..dff2fbac91 100644
--- a/data/2026/CVE-2026-43103.json
+++ b/data/2026/CVE-2026-43103.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wan/lapbether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"698642a01d53107ce9b3fc08bd801284af478a2b","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"ffc5ed59f6dc87c51e8775f002619310225742e8","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"a10570973619cba9dfa6d723177251b846fae587","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"363a38044b8cd5b496d241651a1fb666e7c5fe3e","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"328bb2cff5c2ed973f595ded769e15f4b7a117be","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"63851f60781aa89258c8f0952cd13940aab0888e","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"b117056768ab7deb434e7d72065e48d2083a0c2a","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"b120e4432f9f56c7103133d6a11245e617695adb","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wan/lapbether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.24"},{"lessThan":"2.6.24","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"17EDA983-F673-4AC3-9681-5368A09E90AF","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lapbether: handle NETDEV_PRE_TYPE_CHANGE\n\nlapbeth_data_transmit() expects the underlying device type\nto be ARPHRD_ETHER.\n\nReturning NOTIFY_BAD from lapbeth_device_event() makes sure\nbonding driver can not break this expectation."}],"id":"CVE-2026-43103","lastModified":"2026-06-17T10:48:56.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.867","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/328bb2cff5c2ed973f595ded769e15f4b7a117be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/363a38044b8cd5b496d241651a1fb666e7c5fe3e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63851f60781aa89258c8f0952cd13940aab0888e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/698642a01d53107ce9b3fc08bd801284af478a2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a10570973619cba9dfa6d723177251b846fae587"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b117056768ab7deb434e7d72065e48d2083a0c2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b120e4432f9f56c7103133d6a11245e617695adb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ffc5ed59f6dc87c51e8775f002619310225742e8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wan/lapbether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"698642a01d53107ce9b3fc08bd801284af478a2b","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"ffc5ed59f6dc87c51e8775f002619310225742e8","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"a10570973619cba9dfa6d723177251b846fae587","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"363a38044b8cd5b496d241651a1fb666e7c5fe3e","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"328bb2cff5c2ed973f595ded769e15f4b7a117be","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"63851f60781aa89258c8f0952cd13940aab0888e","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"b117056768ab7deb434e7d72065e48d2083a0c2a","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"},{"lessThan":"b120e4432f9f56c7103133d6a11245e617695adb","status":"affected","version":"872254dd6b1f80cb95ee9e2e22980888533fc293","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wan/lapbether.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.24"},{"lessThan":"2.6.24","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"17EDA983-F673-4AC3-9681-5368A09E90AF","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lapbether: handle NETDEV_PRE_TYPE_CHANGE\n\nlapbeth_data_transmit() expects the underlying device type\nto be ARPHRD_ETHER.\n\nReturning NOTIFY_BAD from lapbeth_device_event() makes sure\nbonding driver can not break this expectation."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: lapbether: manejar NETDEV_PRE_TYPE_CHANGE\n\nlapbeth_data_transmit() espera que el tipo de dispositivo subyacente sea ARPHRD_ETHER.\n\nDevolver NOTIFY_BAD desde lapbeth_device_event() asegura que el controlador de bonding no pueda romper esta expectativa."}],"id":"CVE-2026-43103","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.867","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/328bb2cff5c2ed973f595ded769e15f4b7a117be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/363a38044b8cd5b496d241651a1fb666e7c5fe3e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63851f60781aa89258c8f0952cd13940aab0888e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/698642a01d53107ce9b3fc08bd801284af478a2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a10570973619cba9dfa6d723177251b846fae587"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b117056768ab7deb434e7d72065e48d2083a0c2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b120e4432f9f56c7103133d6a11245e617695adb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ffc5ed59f6dc87c51e8775f002619310225742e8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43104.json b/data/2026/CVE-2026-43104.json
index 843a0789bb..ce50844f4a 100644
--- a/data/2026/CVE-2026-43104.json
+++ b/data/2026/CVE-2026-43104.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c197def3834cbee3fd824ce4c57d08cb24e18955","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"9487daa18e627ac6b5ed5911be79f23362554b70","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"259e2bba3fd7005c62cbd42365a48b3221b244e3","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"dd5c49787a32da96a2b154427eb17cbf12a83c28","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"d8fdd6adc07b78ad3e9ee0004876d90cb59ca941","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"e352e9adc9f6df54d63150ff832f71c04e30744b","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"3eb7dd55021d0f4308fbea0bea21d2118984d8e7","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"9525d169e5fd481538cf8c663cc5839e54f2e481","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FCEFD340-4D12-4082-8086-2A113C4D3AAD","versionEndExcluding":"6.6.136","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Fix a memory leak in hang state error path\n\nWhen vc4_save_hang_state() encounters an early return condition, it\nreturns without freeing the previously allocated `kernel_state`,\nleaking memory.\n\nAdd the missing kfree() calls by consolidating the early return paths\ninto a single place."}],"id":"CVE-2026-43104","lastModified":"2026-06-17T10:48:56.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.980","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/259e2bba3fd7005c62cbd42365a48b3221b244e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3eb7dd55021d0f4308fbea0bea21d2118984d8e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9487daa18e627ac6b5ed5911be79f23362554b70"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9525d169e5fd481538cf8c663cc5839e54f2e481"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c197def3834cbee3fd824ce4c57d08cb24e18955"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8fdd6adc07b78ad3e9ee0004876d90cb59ca941"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd5c49787a32da96a2b154427eb17cbf12a83c28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e352e9adc9f6df54d63150ff832f71c04e30744b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c197def3834cbee3fd824ce4c57d08cb24e18955","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"9487daa18e627ac6b5ed5911be79f23362554b70","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"259e2bba3fd7005c62cbd42365a48b3221b244e3","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"dd5c49787a32da96a2b154427eb17cbf12a83c28","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"d8fdd6adc07b78ad3e9ee0004876d90cb59ca941","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"e352e9adc9f6df54d63150ff832f71c04e30744b","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"3eb7dd55021d0f4308fbea0bea21d2118984d8e7","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"9525d169e5fd481538cf8c663cc5839e54f2e481","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FCEFD340-4D12-4082-8086-2A113C4D3AAD","versionEndExcluding":"6.6.136","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Fix a memory leak in hang state error path\n\nWhen vc4_save_hang_state() encounters an early return condition, it\nreturns without freeing the previously allocated `kernel_state`,\nleaking memory.\n\nAdd the missing kfree() calls by consolidating the early return paths\ninto a single place."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/vc4: Corrección de una fuga de memoria en la ruta de error del estado de bloqueo\n\nCuando vc4_save_hang_state() encuentra una condición de retorno anticipado, retorna sin liberar el ’kernel_state’ previamente asignado, provocando una fuga de memoria.\n\nSe añaden las llamadas a kfree() que faltan consolidando las rutas de retorno anticipado en un único lugar."}],"id":"CVE-2026-43104","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:23.980","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/259e2bba3fd7005c62cbd42365a48b3221b244e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3eb7dd55021d0f4308fbea0bea21d2118984d8e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9487daa18e627ac6b5ed5911be79f23362554b70"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9525d169e5fd481538cf8c663cc5839e54f2e481"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c197def3834cbee3fd824ce4c57d08cb24e18955"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8fdd6adc07b78ad3e9ee0004876d90cb59ca941"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd5c49787a32da96a2b154427eb17cbf12a83c28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e352e9adc9f6df54d63150ff832f71c04e30744b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43105.json b/data/2026/CVE-2026-43105.json
index 37fcf221e7..1d3ebc93d2 100644
--- a/data/2026/CVE-2026-43105.json
+++ b/data/2026/CVE-2026-43105.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7235fc096ece53211bd2c0e958c65f9b802aeb98","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"686bb2fce082f043db50db02b5de5c64ca4dc4c4","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"9c092941fc1d00933bcb46ecac1cb930db3abf5d","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"a812008fe3a0aebb778d277b35717f64e23d0302","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"0d3c014a84396a147705f523a8fd6fc873e76502","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"421cea4f71f7cf65abaae878562ee4aa2b684628","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"b8138567c4a80fd76a647849ebd4284996cf4b17","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"f4dfd6847b3e5d24e336bca6057485116d17aea4","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FCEFD340-4D12-4082-8086-2A113C4D3AAD","versionEndExcluding":"6.6.136","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Fix memory leak of BO array in hang state\n\nThe hang state's BO array is allocated separately with kzalloc() in\nvc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the\nmissing kfree() for the BO array before freeing the hang state struct."}],"id":"CVE-2026-43105","lastModified":"2026-06-17T10:48:56.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:24.097","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d3c014a84396a147705f523a8fd6fc873e76502"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/421cea4f71f7cf65abaae878562ee4aa2b684628"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/686bb2fce082f043db50db02b5de5c64ca4dc4c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7235fc096ece53211bd2c0e958c65f9b802aeb98"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9c092941fc1d00933bcb46ecac1cb930db3abf5d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a812008fe3a0aebb778d277b35717f64e23d0302"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8138567c4a80fd76a647849ebd4284996cf4b17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4dfd6847b3e5d24e336bca6057485116d17aea4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7235fc096ece53211bd2c0e958c65f9b802aeb98","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"686bb2fce082f043db50db02b5de5c64ca4dc4c4","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"9c092941fc1d00933bcb46ecac1cb930db3abf5d","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"a812008fe3a0aebb778d277b35717f64e23d0302","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"0d3c014a84396a147705f523a8fd6fc873e76502","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"421cea4f71f7cf65abaae878562ee4aa2b684628","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"b8138567c4a80fd76a647849ebd4284996cf4b17","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"},{"lessThan":"f4dfd6847b3e5d24e336bca6057485116d17aea4","status":"affected","version":"214613656b5179f0daab6e0a080814b5100d45f0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/vc4/vc4_gem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FCEFD340-4D12-4082-8086-2A113C4D3AAD","versionEndExcluding":"6.6.136","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Fix memory leak of BO array in hang state\n\nThe hang state's BO array is allocated separately with kzalloc() in\nvc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the\nmissing kfree() for the BO array before freeing the hang state struct."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/vc4: Corrección de fuga de memoria del array BO en estado de cuelgue\n\nEl array BO del estado de cuelgue se asigna por separado con kzalloc() en vc4_save_hang_state() pero nunca se libera en vc4_free_hang_state(). Añadir la kfree() faltante para el array BO antes de liberar la estructura del estado de cuelgue."}],"id":"CVE-2026-43105","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:24.097","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d3c014a84396a147705f523a8fd6fc873e76502"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/421cea4f71f7cf65abaae878562ee4aa2b684628"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/686bb2fce082f043db50db02b5de5c64ca4dc4c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7235fc096ece53211bd2c0e958c65f9b802aeb98"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9c092941fc1d00933bcb46ecac1cb930db3abf5d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a812008fe3a0aebb778d277b35717f64e23d0302"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8138567c4a80fd76a647849ebd4284996cf4b17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4dfd6847b3e5d24e336bca6057485116d17aea4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43106.json b/data/2026/CVE-2026-43106.json
index acea1645f0..335966882c 100644
--- a/data/2026/CVE-2026-43106.json
+++ b/data/2026/CVE-2026-43106.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/cachefiles/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6577df7dc7a7de128442b6192c7a32195c923480","status":"affected","version":"7bb1eb45e43c4730cbc5a48b9e9295049fccdacb","versionType":"git"},{"lessThan":"1635c2acdde86c4f555b627aec873c8677c421ed","status":"affected","version":"7bb1eb45e43c4730cbc5a48b9e9295049fccdacb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/cachefiles/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix incorrect dentry refcount in cachefiles_cull()\n\nThe patch mentioned below changed cachefiles_bury_object() to expect 2\nreferences to the 'rep' dentry.  Three of the callers were changed to\nuse start_removing_dentry() which takes an extra reference so in those\ncases the call gets the expected references.\n\nHowever there is another call to cachefiles_bury_object() in\ncachefiles_cull() which did not need to be changed to use\nstart_removing_dentry() and so was not properly considered.\nIt still passed the dentry with just one reference so the net result is\nthat a reference is lost.\n\nTo meet the expectations of cachefiles_bury_object(), cachefiles_cull()\nmust take an extra reference before the call.  It will be dropped by\ncachefiles_bury_object()."}],"id":"CVE-2026-43106","lastModified":"2026-06-17T10:48:56.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:24.213","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1635c2acdde86c4f555b627aec873c8677c421ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6577df7dc7a7de128442b6192c7a32195c923480"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/cachefiles/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6577df7dc7a7de128442b6192c7a32195c923480","status":"affected","version":"7bb1eb45e43c4730cbc5a48b9e9295049fccdacb","versionType":"git"},{"lessThan":"1635c2acdde86c4f555b627aec873c8677c421ed","status":"affected","version":"7bb1eb45e43c4730cbc5a48b9e9295049fccdacb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/cachefiles/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix incorrect dentry refcount in cachefiles_cull()\n\nThe patch mentioned below changed cachefiles_bury_object() to expect 2\nreferences to the 'rep' dentry.  Three of the callers were changed to\nuse start_removing_dentry() which takes an extra reference so in those\ncases the call gets the expected references.\n\nHowever there is another call to cachefiles_bury_object() in\ncachefiles_cull() which did not need to be changed to use\nstart_removing_dentry() and so was not properly considered.\nIt still passed the dentry with just one reference so the net result is\nthat a reference is lost.\n\nTo meet the expectations of cachefiles_bury_object(), cachefiles_cull()\nmust take an extra reference before the call.  It will be dropped by\ncachefiles_bury_object()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncachefiles: corregir recuento de referencias ’dentry’ incorrecto en cachefiles_cull()\n\nEl parche mencionado a continuación cambió cachefiles_bury_object() para esperar 2 referencias a la ’dentry’ ’rep’. Tres de los llamadores fueron cambiados para usar start_removing_dentry() que toma una referencia extra, así que en esos casos la llamada obtiene las referencias esperadas.\n\nSin embargo, hay otra llamada a cachefiles_bury_object() en cachefiles_cull() que no necesitaba ser cambiada para usar start_removing_dentry() y por lo tanto no fue considerada adecuadamente. Todavía pasaba la ’dentry’ con solo una referencia, así que el resultado neto es que se pierde una referencia.\n\nPara cumplir las expectativas de cachefiles_bury_object(), cachefiles_cull() debe tomar una referencia extra antes de la llamada. Será liberada por cachefiles_bury_object()."}],"id":"CVE-2026-43106","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:24.213","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1635c2acdde86c4f555b627aec873c8677c421ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6577df7dc7a7de128442b6192c7a32195c923480"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43107.json b/data/2026/CVE-2026-43107.json
index 36deea45d7..370bd06357 100644
--- a/data/2026/CVE-2026-43107.json
+++ b/data/2026/CVE-2026-43107.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b7dbdc34d22f743abb2c460dfae0d69cd8a45e69","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"f8f3bb89ab677db15f9f5250c77af728f9afe995","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"2c41283d94af943a05f7f2cc1a01f0c872f3cf43","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"e62e322ea20be78e346e4b49f9a6b9f03313af4c","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"58e5735d1a5373652f405a0c16e54ac04aaab0ad","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"7081d46d32312f1a31f0e0e99c6835a394037599","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"201624C3-F55D-45F1-B112-5C2CD4BEE5A6","versionEndExcluding":"6.12.83","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: account XFRMA_IF_ID in aevent size calculation\n\nxfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then\nbuild_aevent() appends attributes including XFRMA_IF_ID when x->if_id is\nset.\n\nxfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states\nwith if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0)\nin xfrm_get_ae(), turning a malformed netlink interaction into a kernel\npanic.\n\nAccount XFRMA_IF_ID in the size calculation unconditionally and replace\nthe BUG_ON with normal error unwinding."}],"id":"CVE-2026-43107","lastModified":"2026-11-06T16:18:22.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43107","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:35.345390Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c41283d94af943a05f7f2cc1a01f0c872f3cf43"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58e5735d1a5373652f405a0c16e54ac04aaab0ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7081d46d32312f1a31f0e0e99c6835a394037599"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b7dbdc34d22f743abb2c460dfae0d69cd8a45e69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e62e322ea20be78e346e4b49f9a6b9f03313af4c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f8f3bb89ab677db15f9f5250c77af728f9afe995"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-131"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b7dbdc34d22f743abb2c460dfae0d69cd8a45e69","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"f8f3bb89ab677db15f9f5250c77af728f9afe995","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"2c41283d94af943a05f7f2cc1a01f0c872f3cf43","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"e62e322ea20be78e346e4b49f9a6b9f03313af4c","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"58e5735d1a5373652f405a0c16e54ac04aaab0ad","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"},{"lessThan":"7081d46d32312f1a31f0e0e99c6835a394037599","status":"affected","version":"7e6526404adedf079279aa7aa11722deaca8fe2e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"201624C3-F55D-45F1-B112-5C2CD4BEE5A6","versionEndExcluding":"6.12.83","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: account XFRMA_IF_ID in aevent size calculation\n\nxfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then\nbuild_aevent() appends attributes including XFRMA_IF_ID when x->if_id is\nset.\n\nxfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states\nwith if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0)\nin xfrm_get_ae(), turning a malformed netlink interaction into a kernel\npanic.\n\nAccount XFRMA_IF_ID in the size calculation unconditionally and replace\nthe BUG_ON with normal error unwinding."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: xfrm: contabilizar XFRMA_IF_ID en el cálculo del tamaño del evento xfrm_get_ae() asigna el skb de respuesta con xfrm_aevent_msgsize(), luego build_aevent() añade atributos incluyendo XFRMA_IF_ID cuando x  ->  if_id está establecido. xfrm_aevent_msgsize() no incluye espacio para XFRMA_IF_ID. Para estados con if_id, build_aevent() puede fallar con -EMSGSIZE y activar BUG_ON(err menor que 0) en xfrm_get_ae(), convirtiendo una interacción netlink malformada en un pánico del kernel. Contabilizar XFRMA_IF_ID en el cálculo del tamaño incondicionalmente y reemplazar el BUG_ON con un desenrollado de errores normal."}],"id":"CVE-2026-43107","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43107","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:35.345390Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c41283d94af943a05f7f2cc1a01f0c872f3cf43"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58e5735d1a5373652f405a0c16e54ac04aaab0ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7081d46d32312f1a31f0e0e99c6835a394037599"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b7dbdc34d22f743abb2c460dfae0d69cd8a45e69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e62e322ea20be78e346e4b49f9a6b9f03313af4c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f8f3bb89ab677db15f9f5250c77af728f9afe995"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-131"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43108.json b/data/2026/CVE-2026-43108.json
index e46b9b5d13..264640938d 100644
--- a/data/2026/CVE-2026-43108.json
+++ b/data/2026/CVE-2026-43108.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/soc/qcom/pdr_internal.h","drivers/soc/qcom/qcom_pdr_msg.c","include/linux/soc/qcom/pdr.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c93ca7c5a72e23a83a0b96f7f5c41a7a72f1dc47","status":"affected","version":"1ebcde047c547134e894508468ead0b7bd3b967d","versionType":"git"},{"lessThan":"7d75145672cf2ec7c5417e3243af72c48314f7bb","status":"affected","version":"1ebcde047c547134e894508468ead0b7bd3b967d","versionType":"git"},{"lessThan":"cba84132c2ac7c08b215ce4962bc6f522c08a88c","status":"affected","version":"1ebcde047c547134e894508468ead0b7bd3b967d","versionType":"git"},{"lessThan":"641f6fda143b879da1515f821ee475073678cf2a","status":"affected","version":"1ebcde047c547134e894508468ead0b7bd3b967d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/soc/qcom/pdr_internal.h","drivers/soc/qcom/qcom_pdr_msg.c","include/linux/soc/qcom/pdr.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABF3F6D0-27D6-43E7-BF38-1B493B03EC1F","versionEndExcluding":"6.12.83","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei\n\nIt looks element length declared in servreg_loc_pfr_req_ei for reason\nnot matching servreg_loc_pfr_req's reason field due which we could\nobserve decoding error on PD crash.\n\n  qmi_decode_string_elem: String len 81 >= Max Len 65\n\nFix this by matching with servreg_loc_pfr_req's reason field."}],"id":"CVE-2026-43108","lastModified":"2026-06-17T10:48:57.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:24.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/641f6fda143b879da1515f821ee475073678cf2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7d75145672cf2ec7c5417e3243af72c48314f7bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c93ca7c5a72e23a83a0b96f7f5c41a7a72f1dc47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cba84132c2ac7c08b215ce4962bc6f522c08a88c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/soc/qcom/pdr_internal.h","drivers/soc/qcom/qcom_pdr_msg.c","include/linux/soc/qcom/pdr.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c93ca7c5a72e23a83a0b96f7f5c41a7a72f1dc47","status":"affected","version":"1ebcde047c547134e894508468ead0b7bd3b967d","versionType":"git"},{"lessThan":"7d75145672cf2ec7c5417e3243af72c48314f7bb","status":"affected","version":"1ebcde047c547134e894508468ead0b7bd3b967d","versionType":"git"},{"lessThan":"cba84132c2ac7c08b215ce4962bc6f522c08a88c","status":"affected","version":"1ebcde047c547134e894508468ead0b7bd3b967d","versionType":"git"},{"lessThan":"641f6fda143b879da1515f821ee475073678cf2a","status":"affected","version":"1ebcde047c547134e894508468ead0b7bd3b967d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/soc/qcom/pdr_internal.h","drivers/soc/qcom/qcom_pdr_msg.c","include/linux/soc/qcom/pdr.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABF3F6D0-27D6-43E7-BF38-1B493B03EC1F","versionEndExcluding":"6.12.83","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: pd-mapper: Fix element length in servreg_loc_pfr_req_ei\n\nIt looks element length declared in servreg_loc_pfr_req_ei for reason\nnot matching servreg_loc_pfr_req's reason field due which we could\nobserve decoding error on PD crash.\n\n  qmi_decode_string_elem: String len 81 >= Max Len 65\n\nFix this by matching with servreg_loc_pfr_req's reason field."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsoc: qcom: pd-mapper: Corregir la longitud del elemento en servreg_loc_pfr_req_ei\n\nParece que la longitud del elemento declarada en servreg_loc_pfr_req_ei para reason no coincide con el campo reason de servreg_loc_pfr_req, debido a lo cual podríamos observar un error de decodificación en un fallo de PD.\n\n  qmi_decode_string_elem: String len 81 >= Max Len 65\n\nCorregir esto haciéndolo coincidir con el campo reason de servreg_loc_pfr_req."}],"id":"CVE-2026-43108","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:24.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/641f6fda143b879da1515f821ee475073678cf2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7d75145672cf2ec7c5417e3243af72c48314f7bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c93ca7c5a72e23a83a0b96f7f5c41a7a72f1dc47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cba84132c2ac7c08b215ce4962bc6f522c08a88c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43109.json b/data/2026/CVE-2026-43109.json
index 657ac241c5..d457fb387f 100644
--- a/data/2026/CVE-2026-43109.json
+++ b/data/2026/CVE-2026-43109.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kernel/shstk.c","include/linux/mmap_lock.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c79cf42321600e931933e11f94aba8b245d4cd66","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"},{"lessThan":"1a30468eff661937d978495644d2e5ebfeef5ce6","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"},{"lessThan":"c64cebcc5c4f223dbcbe7dcdf74908fc092a0aa4","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"},{"lessThan":"262b6d38a81d51b135db81e1f30c13d30e38feee","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"},{"lessThan":"52f657e34d7b21b47434d9d8b26fa7f6778b63a0","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kernel/shstk.c","include/linux/mmap_lock.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.88","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1A24051D-1B64-47EB-A614-9D5B389080ED","versionEndExcluding":"6.18.24","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86: shadow stacks: proper error handling for mmap lock\n\n김영민 reports that shstk_pop_sigframe() doesn't check for errors from\nmmap_read_lock_killable(), which is a silly oversight, and also shows\nthat we haven't marked those functions with \"__must_check\", which would\nhave immediately caught it.\n\nSo let's fix both issues."}],"id":"CVE-2026-43109","lastModified":"2026-11-06T16:18:22.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:39.316247Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1a30468eff661937d978495644d2e5ebfeef5ce6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/262b6d38a81d51b135db81e1f30c13d30e38feee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52f657e34d7b21b47434d9d8b26fa7f6778b63a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c64cebcc5c4f223dbcbe7dcdf74908fc092a0aa4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c79cf42321600e931933e11f94aba8b245d4cd66"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kernel/shstk.c","include/linux/mmap_lock.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c79cf42321600e931933e11f94aba8b245d4cd66","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"},{"lessThan":"1a30468eff661937d978495644d2e5ebfeef5ce6","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"},{"lessThan":"c64cebcc5c4f223dbcbe7dcdf74908fc092a0aa4","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"},{"lessThan":"262b6d38a81d51b135db81e1f30c13d30e38feee","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"},{"lessThan":"52f657e34d7b21b47434d9d8b26fa7f6778b63a0","status":"affected","version":"7fad2a432cd35bbf104d2d9d426e74902f22aa95","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kernel/shstk.c","include/linux/mmap_lock.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.88","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1A24051D-1B64-47EB-A614-9D5B389080ED","versionEndExcluding":"6.18.24","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86: shadow stacks: proper error handling for mmap lock\n\n김영민 reports that shstk_pop_sigframe() doesn't check for errors from\nmmap_read_lock_killable(), which is a silly oversight, and also shows\nthat we haven't marked those functions with \"__must_check\", which would\nhave immediately caught it.\n\nSo let's fix both issues."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86: pilas en la sombra: manejo adecuado de errores para el bloqueo mmap\n\n??? informa que shstk_pop_sigframe() no verifica errores de mmap_read_lock_killable(), lo cual es un descuido tonto, y también muestra que no hemos marcado esas funciones con ’__must_check’, lo que lo habría detectado inmediatamente.\n\nAsí que solucionemos ambos problemas."}],"id":"CVE-2026-43109","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43109","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:39.316247Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1a30468eff661937d978495644d2e5ebfeef5ce6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/262b6d38a81d51b135db81e1f30c13d30e38feee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52f657e34d7b21b47434d9d8b26fa7f6778b63a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c64cebcc5c4f223dbcbe7dcdf74908fc092a0aa4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c79cf42321600e931933e11f94aba8b245d4cd66"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43110.json b/data/2026/CVE-2026-43110.json
index 3ccb4a5a93..3395119b67 100644
--- a/data/2026/CVE-2026-43110.json
+++ b/data/2026/CVE-2026-43110.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b329fbcf075949a038045d8e9b86ae3d5bbd8a54","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"9c81bcc2c695e0082012a2a3d36a0eefaa51579c","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"3ec7437e9d11374105c2c4e47ae671537729d7e6","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"9fca68c2512a362cad258e4df12a307bb2ee4b8e","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"1ae1e1caa428844e481231f6dbe9b4f475f1d52d","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"b427c2b05222db36d32ee141609de6128e9091bb","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"304950a467d83678bd0b0f46331882e2ac23b12d","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.9"},{"lessThan":"3.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6532FC-CF36-43FE-8110-CCB1D829038D","versionEndExcluding":"6.6.136","versionStartIncluding":"3.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: validate bsscfg indices in IF events\n\nbrcmf_fweh_handle_if_event() validates the firmware-provided interface\nindex before it touches drvr->iflist[], but it still uses the raw\nbsscfgidx field as an array index without a matching range check.\n\nReject IF events whose bsscfg index does not fit in drvr->iflist[]\nbefore indexing the interface array.\n\n[add missing wifi prefix]"}],"id":"CVE-2026-43110","lastModified":"2026-10-19T20:18:05.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43110","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:36.984477Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.690","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-129"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b329fbcf075949a038045d8e9b86ae3d5bbd8a54","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"9c81bcc2c695e0082012a2a3d36a0eefaa51579c","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"3ec7437e9d11374105c2c4e47ae671537729d7e6","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"9fca68c2512a362cad258e4df12a307bb2ee4b8e","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"1ae1e1caa428844e481231f6dbe9b4f475f1d52d","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"b427c2b05222db36d32ee141609de6128e9091bb","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"},{"lessThan":"304950a467d83678bd0b0f46331882e2ac23b12d","status":"affected","version":"2880b86859967af710c72f7d34fb421a86a71e22","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.9"},{"lessThan":"3.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6532FC-CF36-43FE-8110-CCB1D829038D","versionEndExcluding":"6.6.136","versionStartIncluding":"3.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: validate bsscfg indices in IF events\n\nbrcmf_fweh_handle_if_event() validates the firmware-provided interface\nindex before it touches drvr->iflist[], but it still uses the raw\nbsscfgidx field as an array index without a matching range check.\n\nReject IF events whose bsscfg index does not fit in drvr->iflist[]\nbefore indexing the interface array.\n\n[add missing wifi prefix]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: brcmfmac: validar índices bsscfg en eventos IF\n\nbrcmf_fweh_handle_if_event() valida el índice de interfaz proporcionado por el firmware antes de que acceda a drvr  ->  iflist[], pero aún utiliza el campo bsscfgidx sin procesar como un índice de array sin una comprobación de rango correspondiente.\n\nRechazar eventos IF cuyo índice bsscfg no cabe en drvr  ->  iflist[] antes de indexar el array de interfaces.\n\n[añadir prefijo wifi faltante]"}],"id":"CVE-2026-43110","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43110","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:36.984477Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.690","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1ae1e1caa428844e481231f6dbe9b4f475f1d52d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2ae3ccb78c0a9ef5ee3d80d02ab319ac1d5af734"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/304950a467d83678bd0b0f46331882e2ac23b12d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3ec7437e9d11374105c2c4e47ae671537729d7e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9c81bcc2c695e0082012a2a3d36a0eefaa51579c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9fca68c2512a362cad258e4df12a307bb2ee4b8e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b329fbcf075949a038045d8e9b86ae3d5bbd8a54"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b427c2b05222db36d32ee141609de6128e9091bb"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-129"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43111.json b/data/2026/CVE-2026-43111.json
index 5ee103f242..0eab7a82d6 100644
--- a/data/2026/CVE-2026-43111.json
+++ b/data/2026/CVE-2026-43111.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-roccat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"20dca865460f7943cf70afca274b60dac371f546","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"441689e3103694caa3e2d62b7d57c7bccefa5e37","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"181ea51ab0f6370842c5b49cfb86824253a1189e","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"e6a445513fbc6a0329d2d5ff375b6725750ec5a6","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"e16a6d11bd77b81632165f02cf0d5946df74b3b7","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"36bb2d0b915014bbdc5044982b31b57b78045b93","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"bca0b595e15450dd66b1153c76c4ef1087ee011b","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"d802d848308b35220f21a8025352f0c0aba15c12","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-roccat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.35"},{"lessThan":"2.6.35","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E870C6A6-0F0A-4202-811D-96F288F882C2","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.35","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: roccat: fix use-after-free in roccat_report_event\n\nroccat_report_event() iterates over the device->readers list without\nholding the readers_lock. This allows a concurrent roccat_release() to\nremove and free a reader while it's still being accessed, leading to a\nuse-after-free.\n\nProtect the readers list traversal with the readers_lock mutex."}],"id":"CVE-2026-43111","lastModified":"2026-10-19T20:18:05.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:39.429610Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.807","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/181ea51ab0f6370842c5b49cfb86824253a1189e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20dca865460f7943cf70afca274b60dac371f546"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36bb2d0b915014bbdc5044982b31b57b78045b93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/441689e3103694caa3e2d62b7d57c7bccefa5e37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bca0b595e15450dd66b1153c76c4ef1087ee011b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d802d848308b35220f21a8025352f0c0aba15c12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e16a6d11bd77b81632165f02cf0d5946df74b3b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6a445513fbc6a0329d2d5ff375b6725750ec5a6"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-roccat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"20dca865460f7943cf70afca274b60dac371f546","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"441689e3103694caa3e2d62b7d57c7bccefa5e37","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"181ea51ab0f6370842c5b49cfb86824253a1189e","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"e6a445513fbc6a0329d2d5ff375b6725750ec5a6","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"e16a6d11bd77b81632165f02cf0d5946df74b3b7","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"36bb2d0b915014bbdc5044982b31b57b78045b93","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"bca0b595e15450dd66b1153c76c4ef1087ee011b","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"},{"lessThan":"d802d848308b35220f21a8025352f0c0aba15c12","status":"affected","version":"206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-roccat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.35"},{"lessThan":"2.6.35","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E870C6A6-0F0A-4202-811D-96F288F882C2","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.35","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: roccat: fix use-after-free in roccat_report_event\n\nroccat_report_event() iterates over the device->readers list without\nholding the readers_lock. This allows a concurrent roccat_release() to\nremove and free a reader while it's still being accessed, leading to a\nuse-after-free.\n\nProtect the readers list traversal with the readers_lock mutex."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: roccat: corrección de uso después de liberación en roccat_report_event\n\nroccat_report_event() itera sobre la lista device  ->  readers sin mantener el readers_lock. Esto permite a un roccat_release() concurrente eliminar y liberar un lector mientras aún está siendo accedido, lo que lleva a un uso después de liberación.\n\nProteger el recorrido de la lista readers con el mutex readers_lock."}],"id":"CVE-2026-43111","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:39.429610Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.807","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/181ea51ab0f6370842c5b49cfb86824253a1189e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20dca865460f7943cf70afca274b60dac371f546"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36bb2d0b915014bbdc5044982b31b57b78045b93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/441689e3103694caa3e2d62b7d57c7bccefa5e37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bca0b595e15450dd66b1153c76c4ef1087ee011b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d802d848308b35220f21a8025352f0c0aba15c12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e16a6d11bd77b81632165f02cf0d5946df74b3b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6a445513fbc6a0329d2d5ff375b6725750ec5a6"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43112.json b/data/2026/CVE-2026-43112.json
index d6c0f76634..dc507bd86d 100644
--- a/data/2026/CVE-2026-43112.json
+++ b/data/2026/CVE-2026-43112.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/fs_context.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a2ba20c17de8eb028f96b1d85f119d3d25655bd9","status":"affected","version":"c63433a09d6ae4c226fcbc66da4c58fc189fd746","versionType":"git"},{"lessThan":"fbced33599653471b4581dfe1abc7b467031f126","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"5d4fe469fe7dbff7d874c196bb680a82f2625d95","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"86f9c23e0814cfdffda9eedf0c591c51ba209010","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"78ec5bf2f589ec7fd8f169394bfeca541b077317","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"5.15.209","status":"affected","version":"5.15.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/fs_context.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.30.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.95.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.141.1.rt7.482.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.141.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.206.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus_long_life:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.206.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.158.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.158.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.22.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.188.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.188.1.rt14.473.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.145.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.134.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.12::el8"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202608241157-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"413.92.202609080414-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"414.92.202609011250-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"416.94.202609011112-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"417.94.202608250221-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"418.94.202609031320-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.19.9.6.202608182320-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202608181658-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202608180431-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.22.9.8.202607152026-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"libkrun","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"005FE1BE-809A-4536-BE37-C2437DE0927E","versionEndExcluding":"6.6.136","versionStartIncluding":"5.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.16:-:*:*:*:*:*:*","matchCriteriaId":"FF588A58-013F-4DBF-A3AB-70EC054B1892","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*","matchCriteriaId":"8A0915FE-A4AA-4C94-B783-CF29D81E7E54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.16:rc7:*:*:*:*:*:*","matchCriteriaId":"4EAC2750-F7C6-4A4E-9C04-1E450722B853","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.16:rc8:*:*:*:*:*:*","matchCriteriaId":"ED611C74-E83A-4AFA-8688-9B829C02B038","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n\nWhen cifs_sanitize_prepath is called with an empty string or a string\ncontaining only delimiters (e.g., \"/\"), the current logic attempts to\ncheck *(cursor2 - 1) before cursor2 has advanced. This results in an\nout-of-bounds read.\n\nThis patch adds an early exit check after stripping prepended\ndelimiters. If no path content remains, the function returns NULL.\n\nThe bug was identified via manual audit and verified using a\nstandalone test case compiled with AddressSanitizer, which\ntriggered a SEGV on affected inputs."}],"id":"CVE-2026-43112","lastModified":"2026-10-19T20:18:05.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:42.861465Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.927","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fbced33599653471b4581dfe1abc7b467031f126"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:34911"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36018"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36365"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36366"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:40764"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52649"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52764"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:53989"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:53990"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:56573"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:57402"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:57457"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:57543"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59662"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59663"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59831"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60019"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62409"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62549"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62558"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62637"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62638"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62639"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62640"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62641"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62642"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:65839"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:65851"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43112"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467015"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43112.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/fs_context.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a2ba20c17de8eb028f96b1d85f119d3d25655bd9","status":"affected","version":"c63433a09d6ae4c226fcbc66da4c58fc189fd746","versionType":"git"},{"lessThan":"fbced33599653471b4581dfe1abc7b467031f126","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"5d4fe469fe7dbff7d874c196bb680a82f2625d95","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"86f9c23e0814cfdffda9eedf0c591c51ba209010","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"78ec5bf2f589ec7fd8f169394bfeca541b077317","status":"affected","version":"a31080899d5fdafcccf7f39dd214a814a2c82626","versionType":"git"},{"lessThan":"5.15.209","status":"affected","version":"5.15.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/fs_context.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.30.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.95.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.141.1.rt7.482.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.141.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.206.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus_long_life:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.206.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.158.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.158.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.22.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.188.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.188.1.rt14.473.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.145.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.134.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.12::el8"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202608241157-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"413.92.202609080414-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"414.92.202609011250-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"416.94.202609011112-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"417.94.202608250221-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"418.94.202609031320-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.19.9.6.202608182320-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202608181658-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202608180431-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.22.9.8.202607152026-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"libkrun","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"005FE1BE-809A-4536-BE37-C2437DE0927E","versionEndExcluding":"6.6.136","versionStartIncluding":"5.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.16:-:*:*:*:*:*:*","matchCriteriaId":"FF588A58-013F-4DBF-A3AB-70EC054B1892","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*","matchCriteriaId":"8A0915FE-A4AA-4C94-B783-CF29D81E7E54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.16:rc7:*:*:*:*:*:*","matchCriteriaId":"4EAC2750-F7C6-4A4E-9C04-1E450722B853","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.16:rc8:*:*:*:*:*:*","matchCriteriaId":"ED611C74-E83A-4AFA-8688-9B829C02B038","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n\nWhen cifs_sanitize_prepath is called with an empty string or a string\ncontaining only delimiters (e.g., \"/\"), the current logic attempts to\ncheck *(cursor2 - 1) before cursor2 has advanced. This results in an\nout-of-bounds read.\n\nThis patch adds an early exit check after stripping prepended\ndelimiters. If no path content remains, the function returns NULL.\n\nThe bug was identified via manual audit and verified using a\nstandalone test case compiled with AddressSanitizer, which\ntriggered a SEGV on affected inputs."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs/smb/cliente: corrección de lectura fuera de límites en cifs_sanitize_prepath\n\nCuando se llama a cifs_sanitize_prepath con una cadena vacía o una cadena que contiene solo delimitadores (p. ej., ’/’), la lógica actual intenta verificar *(cursor2 - 1) antes de que cursor2 haya avanzado. Esto resulta en una lectura fuera de límites.\n\nEste parche añade una verificación de salida temprana después de eliminar los delimitadores antepuestos. Si no queda contenido de ruta, la función devuelve NULL.\n\nEl error fue identificado mediante una auditoría manual y verificado usando un caso de prueba independiente compilado con AddressSanitizer, lo que provocó un SEGV en entradas afectadas."}],"id":"CVE-2026-43112","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:42.861465Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:24.927","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fbced33599653471b4581dfe1abc7b467031f126"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:34911"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36018"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36365"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36366"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:40764"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52649"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:52764"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:53989"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:53990"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:56573"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:57402"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:57457"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:57543"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59662"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59663"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59831"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:60019"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62409"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62549"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62558"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62637"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62638"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62639"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62640"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62641"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62642"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:65839"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:65851"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43112"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467015"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43112.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43113.json b/data/2026/CVE-2026-43113.json
index 190fa60a46..eb6d8ce2a0 100644
--- a/data/2026/CVE-2026-43113.json
+++ b/data/2026/CVE-2026-43113.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ti/wl1251/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6509dbece7339dbc8980c706b9d623119a6de105","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"e0dc1ad870d6788b049bfe1511ac75b2333a7550","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"b6ba1eacf276063ebeefbbae8056043c24f2efaf","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"df15adc692a802636dd3f258fc7cca8bf7a0ed9a","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"8d7465be5163a923ee5d7459719ef5a021c1584a","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"26ee518695c484f75e3606d631278e84bd24ae02","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ti/wl1251/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F537DD4C-1540-41DE-85CB-6B14F7030A5F","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wl1251: validate packet IDs before indexing tx_frames\n\nwl1251_tx_packet_cb() uses the firmware completion ID directly to index\nthe fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the\ncompletion block, and the callback does not currently verify that it\nfits the array before dereferencing it.\n\nReject completion IDs that fall outside wl->tx_frames[] and keep the\nexisting NULL check in the same guard. This keeps the fix local to the\ntrust boundary and avoids touching the rest of the completion flow."}],"id":"CVE-2026-43113","lastModified":"2026-06-17T10:48:57.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:25.050","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26ee518695c484f75e3606d631278e84bd24ae02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6509dbece7339dbc8980c706b9d623119a6de105"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d7465be5163a923ee5d7459719ef5a021c1584a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6ba1eacf276063ebeefbbae8056043c24f2efaf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df15adc692a802636dd3f258fc7cca8bf7a0ed9a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e0dc1ad870d6788b049bfe1511ac75b2333a7550"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ti/wl1251/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6509dbece7339dbc8980c706b9d623119a6de105","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"e0dc1ad870d6788b049bfe1511ac75b2333a7550","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"b6ba1eacf276063ebeefbbae8056043c24f2efaf","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"df15adc692a802636dd3f258fc7cca8bf7a0ed9a","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"8d7465be5163a923ee5d7459719ef5a021c1584a","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"26ee518695c484f75e3606d631278e84bd24ae02","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"},{"lessThan":"0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0","status":"affected","version":"2f01a1f58889fbfeb68b1bc1b52e4197f3333490","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ti/wl1251/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F537DD4C-1540-41DE-85CB-6B14F7030A5F","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wl1251: validate packet IDs before indexing tx_frames\n\nwl1251_tx_packet_cb() uses the firmware completion ID directly to index\nthe fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the\ncompletion block, and the callback does not currently verify that it\nfits the array before dereferencing it.\n\nReject completion IDs that fall outside wl->tx_frames[] and keep the\nexisting NULL check in the same guard. This keeps the fix local to the\ntrust boundary and avoids touching the rest of the completion flow."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nwifi: wl1251: validar los ID de paquete antes de indexar tx_frames\n\nwl1251_tx_packet_cb() utiliza el ID de finalización del firmware directamente para indexar el array fijo de 16 entradas wl  ->  tx_frames[]. El ID es un u8 en bruto del bloque de finalización, y la función de callback no verifica actualmente que se ajuste al array antes de desreferenciarlo.\n\nRechazar los ID de finalización que queden fuera de wl  ->  tx_frames[] y mantener la comprobación de NULL existente en la misma protección. Esto mantiene la corrección local al límite de confianza y evita tocar el resto del flujo de finalización."}],"id":"CVE-2026-43113","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T10:16:25.050","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26ee518695c484f75e3606d631278e84bd24ae02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6509dbece7339dbc8980c706b9d623119a6de105"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d7465be5163a923ee5d7459719ef5a021c1584a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6ba1eacf276063ebeefbbae8056043c24f2efaf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df15adc692a802636dd3f258fc7cca8bf7a0ed9a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e0dc1ad870d6788b049bfe1511ac75b2333a7550"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43114.json b/data/2026/CVE-2026-43114.json
index 879b1b6238..562c2c282d 100644
--- a/data/2026/CVE-2026-43114.json
+++ b/data/2026/CVE-2026-43114.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nft_set_pipapo_avx2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f8c39983fc9c1a978c82e6f2df7bfba8a8561587","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"c7babe2f28b507e17f28e9f753b7caec72d4857f","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"1c43f0dd8691ddf8884793b481ddc7511cf593c3","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"fa4f1f52528c73989d820f32bfca06bec5afeece","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"3d53f9aafd469ae1ea27051e00f5b96ca1b55d52","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"07de44424bb7f17ef9357e8535df96d9e97c40cb","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"0abbc43f71d99baadeeba6fa3fe1c80b676f57ed","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"d3c0037ffe1273fa1961e779ff6906234d6cf53c","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nft_set_pipapo_avx2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.103.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.42.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.191.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.191.1.rt14.476.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.149.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.138.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202609092300-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202609090322-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.22.9.8.202609020733-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"libkrun","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unknown","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BC0C578E-B609-43BE-90EB-06C9FE9CA83D","versionEndExcluding":"6.6.136","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry\n\nNew test case fails unexpectedly when avx2 matching functions are used.\n\nThe test first loads a ranomly generated pipapo set\nwith 'ipv4 . port' key, i.e.  nft -f foo.\n\nThis works.  Then, it reloads the set after a flush:\n(echo flush set t s; cat foo) | nft -f -\n\nThis is expected to work, because its the same set after all and it was\nalready loaded once.\n\nBut with avx2, this fails: nft reports a clashing element.\n\nThe reported clash is of following form:\n\n    We successfully re-inserted\n      a . b\n      c . d\n\nThen we try to insert a . d\n\navx2 finds the already existing a . d, which (due to 'flush set') is marked\nas invalid in the new generation.  It skips the element and moves to next.\n\nDue to incorrect masking, the skip-step finds the next matching\nelement *only considering the first field*,\n\ni.e. we return the already reinserted \"a . b\", even though the\nlast field is different and the entry should not have been matched.\n\nNo such error is reported for the generic c implementation (no avx2) or when\nthe last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.\n\nBisection points to\n7711f4bb4b36 (\"netfilter: nft_set_pipapo: fix range overlap detection\")\nbut that fix merely uncovers this bug.\n\nBefore this commit, the wrong element is returned, but erronously\nreported as a full, identical duplicate.\n\nThe root-cause is too early return in the avx2 match functions.\nWhen we process the last field, we should continue to process data\nuntil the entire input size has been consumed to make sure no stale\nbits remain in the map."}],"id":"CVE-2026-43114","lastModified":"2026-10-19T20:18:06.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43114","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:45.186555Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.163","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1c43f0dd8691ddf8884793b481ddc7511cf593c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c7babe2f28b507e17f28e9f753b7caec72d4857f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f8c39983fc9c1a978c82e6f2df7bfba8a8561587"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa4f1f52528c73989d820f32bfca06bec5afeece"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59723"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62568"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62638"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62639"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62640"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62641"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62642"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:63093"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:64767"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:65712"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66351"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66370"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66376"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67721"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67723"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43114"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466994"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43114.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-480"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nft_set_pipapo_avx2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f8c39983fc9c1a978c82e6f2df7bfba8a8561587","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"c7babe2f28b507e17f28e9f753b7caec72d4857f","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"1c43f0dd8691ddf8884793b481ddc7511cf593c3","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"fa4f1f52528c73989d820f32bfca06bec5afeece","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"3d53f9aafd469ae1ea27051e00f5b96ca1b55d52","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"07de44424bb7f17ef9357e8535df96d9e97c40cb","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"0abbc43f71d99baadeeba6fa3fe1c80b676f57ed","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"},{"lessThan":"d3c0037ffe1273fa1961e779ff6906234d6cf53c","status":"affected","version":"7400b063969bdca4a06cd97f1294d765c8eecbe1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nft_set_pipapo_avx2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.103.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.42.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.191.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.191.1.rt14.476.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.149.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.138.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202609092300-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202609090322-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.22.9.8.202609020733-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"libkrun","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unknown","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BC0C578E-B609-43BE-90EB-06C9FE9CA83D","versionEndExcluding":"6.6.136","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry\n\nNew test case fails unexpectedly when avx2 matching functions are used.\n\nThe test first loads a ranomly generated pipapo set\nwith 'ipv4 . port' key, i.e.  nft -f foo.\n\nThis works.  Then, it reloads the set after a flush:\n(echo flush set t s; cat foo) | nft -f -\n\nThis is expected to work, because its the same set after all and it was\nalready loaded once.\n\nBut with avx2, this fails: nft reports a clashing element.\n\nThe reported clash is of following form:\n\n    We successfully re-inserted\n      a . b\n      c . d\n\nThen we try to insert a . d\n\navx2 finds the already existing a . d, which (due to 'flush set') is marked\nas invalid in the new generation.  It skips the element and moves to next.\n\nDue to incorrect masking, the skip-step finds the next matching\nelement *only considering the first field*,\n\ni.e. we return the already reinserted \"a . b\", even though the\nlast field is different and the entry should not have been matched.\n\nNo such error is reported for the generic c implementation (no avx2) or when\nthe last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.\n\nBisection points to\n7711f4bb4b36 (\"netfilter: nft_set_pipapo: fix range overlap detection\")\nbut that fix merely uncovers this bug.\n\nBefore this commit, the wrong element is returned, but erronously\nreported as a full, identical duplicate.\n\nThe root-cause is too early return in the avx2 match functions.\nWhen we process the last field, we should continue to process data\nuntil the entire input size has been consumed to make sure no stale\nbits remain in the map."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nft_set_pipapo_avx2: no devolver una entrada no coincidente al expirar\n\nUn nuevo caso de prueba falla inesperadamente cuando se utilizan funciones de coincidencia avx2.\n\nLa prueba primero carga un conjunto pipapo generado aleatoriamente\ncon clave ’ipv4 . puerto’, es decir, nft -f foo.\n\nEsto funciona. Luego, recarga el conjunto después de un vaciado:\n(echo flush set t s; cat foo) | nft -f -\n\nSe espera que esto funcione, porque es el mismo conjunto después de todo y ya se había cargado una vez.\n\nPero con avx2, esto falla: nft informa de un elemento en conflicto.\n\nEl conflicto reportado es de la siguiente forma:\n\n    Reinsertamos con éxito\n      a . b\n      c . d\n\nLuego intentamos insertar a . d\n\navx2 encuentra el a . d ya existente, el cual (debido a ’flush set’) está marcado\ncomo inválido en la nueva generación. Omite el elemento y pasa al siguiente.\n\nDebido a un enmascaramiento incorrecto, el paso de omisión encuentra el siguiente elemento coincidente solo considerando el primer campo,\n\nes decir, devolvemos el “a . b” ya reinsertado, aunque el\núltimo campo es diferente y la entrada no debería haber coincidido.\n\nNo se informa de tal error para la implementación genérica en C (sin avx2) o cuando\nel último campo tiene que usar el mecanismo de reserva ’nft_pipapo_avx2_lookup_slow’.\n\nLa bisección apunta a\n7711f4bb4b36 (’netfilter: nft_set_pipapo: corregir la detección de superposición de rangos’)\npero esa corrección simplemente desvela este error.\n\nAntes de este commit, se devuelve el elemento incorrecto, pero se informa erróneamente\ncomo un duplicado completo e idéntico.\n\nLa causa raíz es un retorno demasiado temprano en las funciones de coincidencia avx2.\nCuando procesamos el último campo, deberíamos continuar procesando datos\nhasta que se haya consumido todo el tamaño de entrada para asegurarnos de que no queden\nbits obsoletos en el mapa."}],"id":"CVE-2026-43114","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43114","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:45.186555Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.163","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07de44424bb7f17ef9357e8535df96d9e97c40cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0abbc43f71d99baadeeba6fa3fe1c80b676f57ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1c43f0dd8691ddf8884793b481ddc7511cf593c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d53f9aafd469ae1ea27051e00f5b96ca1b55d52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c7babe2f28b507e17f28e9f753b7caec72d4857f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3c0037ffe1273fa1961e779ff6906234d6cf53c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f8c39983fc9c1a978c82e6f2df7bfba8a8561587"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa4f1f52528c73989d820f32bfca06bec5afeece"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59723"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62568"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62638"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62639"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62640"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62641"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:62642"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:63093"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:64767"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:65712"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66351"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66370"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66376"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67721"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67723"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43114"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466994"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43114.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-480"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43115.json b/data/2026/CVE-2026-43115.json
index aedb27d773..7b0e68a188 100644
--- a/data/2026/CVE-2026-43115.json
+++ b/data/2026/CVE-2026-43115.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/srcutiny.h","kernel/rcu/srcutiny.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"28768bc7ea0b13f558a70f63cc3cfcd32d55d488","status":"affected","version":"d8be81735aa89413b333de488251f0e64e2be591","versionType":"git"},{"lessThan":"bb37286db65368cb72ba8757ad86299c4e4a73fc","status":"affected","version":"d8be81735aa89413b333de488251f0e64e2be591","versionType":"git"},{"lessThan":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","status":"affected","version":"d8be81735aa89413b333de488251f0e64e2be591","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/srcutiny.h","kernel/rcu/srcutiny.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2D2EA261-943C-485F-BC27-BE526335CA60","versionEndExcluding":"6.19.14","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Use irq_work to start GP in tiny SRCU\n\nTiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),\nwhich acquires the workqueue pool->lock.\n\nThis causes a lockdep splat when call_srcu() is called with a scheduler\nlock held, due to:\n\n  call_srcu() [holding pi_lock]\n    srcu_gp_start_if_needed()\n      schedule_work() -> pool->lock\n\n  workqueue_init() / create_worker() [holding pool->lock]\n    wake_up_process() -> try_to_wake_up() -> pi_lock\n\nAlso add irq_work_sync() to cleanup_srcu_struct() to prevent a\nuse-after-free if a queued irq_work fires after cleanup begins.\n\nTested with rcutorture SRCU-T and no lockdep warnings.\n\n[ Thanks to Boqun for similar fix in patch \"rcu: Use an intermediate irq_work\nto start process_srcu()\" ]"}],"id":"CVE-2026-43115","lastModified":"2026-10-30T13:18:45.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:25.290","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/srcutiny.h","kernel/rcu/srcutiny.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"28768bc7ea0b13f558a70f63cc3cfcd32d55d488","status":"affected","version":"d8be81735aa89413b333de488251f0e64e2be591","versionType":"git"},{"lessThan":"bb37286db65368cb72ba8757ad86299c4e4a73fc","status":"affected","version":"d8be81735aa89413b333de488251f0e64e2be591","versionType":"git"},{"lessThan":"a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","status":"affected","version":"d8be81735aa89413b333de488251f0e64e2be591","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/srcutiny.h","kernel/rcu/srcutiny.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2D2EA261-943C-485F-BC27-BE526335CA60","versionEndExcluding":"6.19.14","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Use irq_work to start GP in tiny SRCU\n\nTiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),\nwhich acquires the workqueue pool->lock.\n\nThis causes a lockdep splat when call_srcu() is called with a scheduler\nlock held, due to:\n\n  call_srcu() [holding pi_lock]\n    srcu_gp_start_if_needed()\n      schedule_work() -> pool->lock\n\n  workqueue_init() / create_worker() [holding pool->lock]\n    wake_up_process() -> try_to_wake_up() -> pi_lock\n\nAlso add irq_work_sync() to cleanup_srcu_struct() to prevent a\nuse-after-free if a queued irq_work fires after cleanup begins.\n\nTested with rcutorture SRCU-T and no lockdep warnings.\n\n[ Thanks to Boqun for similar fix in patch \"rcu: Use an intermediate irq_work\nto start process_srcu()\" ]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsrcu: Usar irq_work para iniciar GP en tiny SRCU\n\nEl srcu_gp_start_if_needed() de Tiny SRCU llama directamente a schedule_work(), que adquiere el pool  ->  lock de la workqueue.\n\nEsto causa un lockdep splat cuando se llama a call_srcu() con un bloqueo del planificador mantenido, debido a:\n\n  call_srcu() [manteniendo pi_lock]\n    srcu_gp_start_if_needed()\n      schedule_work()   ->   pool  ->  lock\n\n  workqueue_init() / create_worker() [manteniendo pool  ->  lock]\n    wake_up_process()   ->   try_to_wake_up()   ->   pi_lock\n\nTambién añadir irq_work_sync() a cleanup_srcu_struct() para prevenir un uso después de liberación si un irq_work en cola se dispara después de que comience la limpieza.\n\nProbado con rcutorture SRCU-T y sin advertencias de lockdep.\n\n[ Gracias a Boqun por una corrección similar en el parche ’rcu: Usar un irq_work intermedio para iniciar process_srcu()’ ]"}],"id":"CVE-2026-43115","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:25.290","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43116.json b/data/2026/CVE-2026-43116.json
index 21dfc6ba53..252383de79 100644
--- a/data/2026/CVE-2026-43116.json
+++ b/data/2026/CVE-2026-43116.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_core.h","net/netfilter/nf_conntrack_ecache.c","net/netfilter/nf_conntrack_expect.c","net/netfilter/nf_conntrack_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9e1196d27ef496f404c76f7a9d03761142d991c4","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"5e1c1d22268ae710c238342c8030c21daf298168","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"d52fa1fa7440676b8c238037a050ab008c22737f","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"f338ced0473849c9f6ed0b77ca99f1aab5826787","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"497f99b26fffdc5635706d1b4811f1ed8ee21a5b","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_core.h","net/netfilter/nf_conntrack_ecache.c","net/netfilter/nf_conntrack_expect.c","net/netfilter/nf_conntrack_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.16"},{"lessThan":"2.6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.94","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0D55758C-FA92-4C05-99B4-542E75635240","versionEndExcluding":"6.18.24","versionStartIncluding":"2.6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: ensure safe access to master conntrack\n\nHolding reference on the expectation is not sufficient, the master\nconntrack object can just go away, making exp->master invalid.\n\nTo access exp->master safely:\n\n- Grab the nf_conntrack_expect_lock, this gets serialized with\n  clean_from_lists() which also holds this lock when the master\n  conntrack goes away.\n\n- Hold reference on master conntrack via nf_conntrack_find_get().\n  Not so easy since the master tuple to look up for the master conntrack\n  is not available in the existing problematic paths.\n\nThis patch goes for extending the nf_conntrack_expect_lock section\nto address this issue for simplicity, in the cases that are described\nbelow this is just slightly extending the lock section.\n\nThe add expectation command already holds a reference to the master\nconntrack from ctnetlink_create_expect().\n\nHowever, the delete expectation command needs to grab the spinlock\nbefore looking up for the expectation. Expand the existing spinlock\nsection to address this to cover the expectation lookup. Note that,\nthe nf_ct_expect_iterate_net() calls already grabs the spinlock while\niterating over the expectation table, which is correct.\n\nThe get expectation command needs to grab the spinlock to ensure master\nconntrack does not go away. This also expands the existing spinlock\nsection to cover the expectation lookup too. I needed to move the\nnetlink skb allocation out of the spinlock to keep it GFP_KERNEL.\n\nFor the expectation events, the IPEXP_DESTROY event is already delivered\nunder the spinlock, just move the delivery of IPEXP_NEW under the\nspinlock too because the master conntrack event cache is reached through\nexp->master.\n\nWhile at it, add lockdep notations to help identify what codepaths need\nto grab the spinlock."}],"id":"CVE-2026-43116","lastModified":"2026-11-10T13:19:11.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43116","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:47.387968Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.400","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/497f99b26fffdc5635706d1b4811f1ed8ee21a5b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5e1c1d22268ae710c238342c8030c21daf298168"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e1196d27ef496f404c76f7a9d03761142d991c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d52fa1fa7440676b8c238037a050ab008c22737f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f338ced0473849c9f6ed0b77ca99f1aab5826787"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_core.h","net/netfilter/nf_conntrack_ecache.c","net/netfilter/nf_conntrack_expect.c","net/netfilter/nf_conntrack_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9e1196d27ef496f404c76f7a9d03761142d991c4","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"5e1c1d22268ae710c238342c8030c21daf298168","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"d52fa1fa7440676b8c238037a050ab008c22737f","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"f338ced0473849c9f6ed0b77ca99f1aab5826787","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"497f99b26fffdc5635706d1b4811f1ed8ee21a5b","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"},{"lessThan":"bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5","status":"affected","version":"c1d10adb4a521de5760112853f42aaeefcec96eb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_core.h","net/netfilter/nf_conntrack_ecache.c","net/netfilter/nf_conntrack_expect.c","net/netfilter/nf_conntrack_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.16"},{"lessThan":"2.6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.94","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0D55758C-FA92-4C05-99B4-542E75635240","versionEndExcluding":"6.18.24","versionStartIncluding":"2.6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: ensure safe access to master conntrack\n\nHolding reference on the expectation is not sufficient, the master\nconntrack object can just go away, making exp->master invalid.\n\nTo access exp->master safely:\n\n- Grab the nf_conntrack_expect_lock, this gets serialized with\n  clean_from_lists() which also holds this lock when the master\n  conntrack goes away.\n\n- Hold reference on master conntrack via nf_conntrack_find_get().\n  Not so easy since the master tuple to look up for the master conntrack\n  is not available in the existing problematic paths.\n\nThis patch goes for extending the nf_conntrack_expect_lock section\nto address this issue for simplicity, in the cases that are described\nbelow this is just slightly extending the lock section.\n\nThe add expectation command already holds a reference to the master\nconntrack from ctnetlink_create_expect().\n\nHowever, the delete expectation command needs to grab the spinlock\nbefore looking up for the expectation. Expand the existing spinlock\nsection to address this to cover the expectation lookup. Note that,\nthe nf_ct_expect_iterate_net() calls already grabs the spinlock while\niterating over the expectation table, which is correct.\n\nThe get expectation command needs to grab the spinlock to ensure master\nconntrack does not go away. This also expands the existing spinlock\nsection to cover the expectation lookup too. I needed to move the\nnetlink skb allocation out of the spinlock to keep it GFP_KERNEL.\n\nFor the expectation events, the IPEXP_DESTROY event is already delivered\nunder the spinlock, just move the delivery of IPEXP_NEW under the\nspinlock too because the master conntrack event cache is reached through\nexp->master.\n\nWhile at it, add lockdep notations to help identify what codepaths need\nto grab the spinlock."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: ctnetlink: asegurar acceso seguro a conntrack maestro\n\nMantener una referencia sobre la expectativa no es suficiente, el objeto conntrack maestro puede simplemente desaparecer, haciendo que exp  ->  master sea inválido.\n\nPara acceder a exp  ->  master de forma segura:\n\n- Adquirir el nf_conntrack_expect_lock, esto se serializa con clean_from_lists() que también mantiene este bloqueo cuando el conntrack maestro desaparece.\n\n- Mantener una referencia sobre el conntrack maestro a través de nf_conntrack_find_get(). No es tan fácil ya que la tupla maestra para buscar el conntrack maestro no está disponible en las rutas problemáticas existentes.\n\nEste parche opta por extender la sección nf_conntrack_expect_lock para abordar este problema por simplicidad; en los casos que se describen a continuación, esto solo extiende ligeramente la sección de bloqueo.\n\nEl comando de añadir expectativa ya mantiene una referencia al conntrack maestro desde ctnetlink_create_expect().\n\nSin embargo, el comando de eliminar expectativa necesita adquirir el spinlock antes de buscar la expectativa. Expandir la sección de spinlock existente para abordar esto y cubrir la búsqueda de la expectativa. Tenga en cuenta que las llamadas a nf_ct_expect_iterate_net() ya adquieren el spinlock mientras iteran sobre la tabla de expectativas, lo cual es correcto.\n\nEl comando de obtener expectativa necesita adquirir el spinlock para asegurar que el conntrack maestro no desaparezca. Esto también expande la sección de spinlock existente para cubrir también la búsqueda de la expectativa. Necesité mover la asignación de netlink skb fuera del spinlock para mantenerla GFP_KERNEL.\n\nPara los eventos de expectativa, el evento IPEXP_DESTROY ya se entrega bajo el spinlock; simplemente mueva la entrega de IPEXP_NEW también bajo el spinlock porque la caché de eventos del conntrack maestro se alcanza a través de exp  ->  master.\n\nYa que estamos, añada anotaciones de lockdep para ayudar a identificar qué rutas de código necesitan adquirir el spinlock."}],"id":"CVE-2026-43116","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43116","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:47.387968Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.400","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/497f99b26fffdc5635706d1b4811f1ed8ee21a5b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5e1c1d22268ae710c238342c8030c21daf298168"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e1196d27ef496f404c76f7a9d03761142d991c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d52fa1fa7440676b8c238037a050ab008c22737f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f338ced0473849c9f6ed0b77ca99f1aab5826787"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43117.json b/data/2026/CVE-2026-43117.json
index 1c13b7e3cf..94892040b2 100644
--- a/data/2026/CVE-2026-43117.json
+++ b/data/2026/CVE-2026-43117.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/trace/events/btrfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4a7bab35fad5251c8cb738161152578cd83b6b9c","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"520e8b4bcf872a534a7bf61ccf880047642df296","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"e252db8ca2a01f82d472091f35d549b313278636","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"c09a7446aab5773f38d6abb25fce99b8e1dfbc97","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"32372781d664a9b03c40343e96c29d0a6139f97d","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"d110d7cdb045715c0b45b0dfd974525bb38f653d","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"a85b46db143fda5869e7d8df8f258ccef5fa1719","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/trace/events/btrfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.8"},{"lessThan":"4.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"130C6A37-2766-49E1-848F-2410950B4262","versionEndExcluding":"6.6.136","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()\n\nIf overlay is used on top of btrfs, dentry->d_sb translates to overlay's\nsuper block and fsid assignment will lead to a crash.\n\nUse file_inode(file)->i_sb to always get btrfs_sb."}],"id":"CVE-2026-43117","lastModified":"2026-10-19T20:18:06.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43117","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:49.924916Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.513","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/32372781d664a9b03c40343e96c29d0a6139f97d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4a7bab35fad5251c8cb738161152578cd83b6b9c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/520e8b4bcf872a534a7bf61ccf880047642df296"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a85b46db143fda5869e7d8df8f258ccef5fa1719"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c09a7446aab5773f38d6abb25fce99b8e1dfbc97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e252db8ca2a01f82d472091f35d549b313278636"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-476"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/trace/events/btrfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4a7bab35fad5251c8cb738161152578cd83b6b9c","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"520e8b4bcf872a534a7bf61ccf880047642df296","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"e252db8ca2a01f82d472091f35d549b313278636","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"c09a7446aab5773f38d6abb25fce99b8e1dfbc97","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"32372781d664a9b03c40343e96c29d0a6139f97d","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"d110d7cdb045715c0b45b0dfd974525bb38f653d","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"},{"lessThan":"a85b46db143fda5869e7d8df8f258ccef5fa1719","status":"affected","version":"bc074524e123ded281cde25ebc5661910f9679e3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/trace/events/btrfs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.8"},{"lessThan":"4.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"130C6A37-2766-49E1-848F-2410950B4262","versionEndExcluding":"6.6.136","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()\n\nIf overlay is used on top of btrfs, dentry->d_sb translates to overlay's\nsuper block and fsid assignment will lead to a crash.\n\nUse file_inode(file)->i_sb to always get btrfs_sb."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: tracepoints: obtener el superbloque correcto de dentry en el evento btrfs_sync_file()\n\nSi se usa overlay sobre btrfs, dentry  ->  d_sb se traduce al superbloque de overlay y la asignación de fsid provocará un fallo.\n\nUsar file_inode(file)  ->  i_sb para obtener siempre btrfs_sb."}],"id":"CVE-2026-43117","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43117","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:49.924916Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.513","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/32372781d664a9b03c40343e96c29d0a6139f97d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4a7bab35fad5251c8cb738161152578cd83b6b9c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/520e8b4bcf872a534a7bf61ccf880047642df296"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a85b46db143fda5869e7d8df8f258ccef5fa1719"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c09a7446aab5773f38d6abb25fce99b8e1dfbc97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e252db8ca2a01f82d472091f35d549b313278636"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-476"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43118.json b/data/2026/CVE-2026-43118.json
index 1de5768192..4ee9ac6ed6 100644
--- a/data/2026/CVE-2026-43118.json
+++ b/data/2026/CVE-2026-43118.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/tree-log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"126999610eddeb1de3b47680585f4bc9531dc7f4","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"c939bfa67d221f75351a5bf2fc912e8125547b7e","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"91990732ec4ce5c09361d498c6d621f5a76ee1f2","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"fddb157536e67a055597f00a8b4922d5f5ed0826","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"03e966b63df5b06790310c1faaf3e0cb43adea8b","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"5254d4181add9dfaa5e3519edd71cc8f752b2f85","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/tree-log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7560884D-457B-4E3F-9047-894A786C1273","versionEndExcluding":"6.18.24","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix zero size inode with non-zero size after log replay\n\nWhen logging that an inode exists, as part of logging a new name or\nlogging new dir entries for a directory, we always set the generation of\nthe logged inode item to 0. This is to signal during log replay (in\noverwrite_item()), that we should not set the i_size since we only logged\nthat an inode exists, so the i_size of the inode in the subvolume tree\nmust be preserved (as when we log new names or that an inode exists, we\ndon't log extents).\n\nThis works fine except when we have already logged an inode in full mode\nor it's the first time we are logging an inode created in a past\ntransaction, that inode has a new i_size of 0 and then we log a new name\nfor the inode (due to a new hardlink or a rename), in which case we log\nan i_size of 0 for the inode and a generation of 0, which causes the log\nreplay code to not update the inode's i_size to 0 (in overwrite_item()).\n\nAn example scenario:\n\n  mkdir /mnt/dir\n  xfs_io -f -c \"pwrite 0 64K\" /mnt/dir/foo\n\n  sync\n\n  xfs_io -c \"truncate 0\" -c \"fsync\" /mnt/dir/foo\n\n  ln /mnt/dir/foo /mnt/dir/bar\n\n  xfs_io -c \"fsync\" /mnt/dir\n\n  <power fail>\n\nAfter log replay the file remains with a size of 64K. This is because when\nwe first log the inode, when we fsync file foo, we log its current i_size\nof 0, and then when we create a hard link we log again the inode in exists\nmode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we\nadd to the log tree, so during log replay overwrite_item() sees that the\ngeneration is 0 and i_size is 0 so we skip updating the inode's i_size\nfrom 64K to 0.\n\nFix this by making sure at fill_inode_item() we always log the real\ngeneration of the inode if it was logged in the current transaction with\nthe i_size we logged before. Also if an inode created in a previous\ntransaction is logged in exists mode only, make sure we log the i_size\nstored in the inode item located from the commit root, so that if we log\nmultiple times that the inode exists we get the correct i_size.\n\nA test case for fstests will follow soon."}],"id":"CVE-2026-43118","lastModified":"2026-10-30T13:18:46.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:25.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03e966b63df5b06790310c1faaf3e0cb43adea8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/126999610eddeb1de3b47680585f4bc9531dc7f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5254d4181add9dfaa5e3519edd71cc8f752b2f85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/91990732ec4ce5c09361d498c6d621f5a76ee1f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c939bfa67d221f75351a5bf2fc912e8125547b7e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fddb157536e67a055597f00a8b4922d5f5ed0826"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/tree-log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"126999610eddeb1de3b47680585f4bc9531dc7f4","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"c939bfa67d221f75351a5bf2fc912e8125547b7e","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"91990732ec4ce5c09361d498c6d621f5a76ee1f2","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"fddb157536e67a055597f00a8b4922d5f5ed0826","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"03e966b63df5b06790310c1faaf3e0cb43adea8b","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"},{"lessThan":"5254d4181add9dfaa5e3519edd71cc8f752b2f85","status":"affected","version":"12fcfd22fe5bf4fe74710232098bc101af497995","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/tree-log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.30"},{"lessThan":"2.6.30","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7560884D-457B-4E3F-9047-894A786C1273","versionEndExcluding":"6.18.24","versionStartIncluding":"2.6.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix zero size inode with non-zero size after log replay\n\nWhen logging that an inode exists, as part of logging a new name or\nlogging new dir entries for a directory, we always set the generation of\nthe logged inode item to 0. This is to signal during log replay (in\noverwrite_item()), that we should not set the i_size since we only logged\nthat an inode exists, so the i_size of the inode in the subvolume tree\nmust be preserved (as when we log new names or that an inode exists, we\ndon't log extents).\n\nThis works fine except when we have already logged an inode in full mode\nor it's the first time we are logging an inode created in a past\ntransaction, that inode has a new i_size of 0 and then we log a new name\nfor the inode (due to a new hardlink or a rename), in which case we log\nan i_size of 0 for the inode and a generation of 0, which causes the log\nreplay code to not update the inode's i_size to 0 (in overwrite_item()).\n\nAn example scenario:\n\n  mkdir /mnt/dir\n  xfs_io -f -c \"pwrite 0 64K\" /mnt/dir/foo\n\n  sync\n\n  xfs_io -c \"truncate 0\" -c \"fsync\" /mnt/dir/foo\n\n  ln /mnt/dir/foo /mnt/dir/bar\n\n  xfs_io -c \"fsync\" /mnt/dir\n\n  <power fail>\n\nAfter log replay the file remains with a size of 64K. This is because when\nwe first log the inode, when we fsync file foo, we log its current i_size\nof 0, and then when we create a hard link we log again the inode in exists\nmode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we\nadd to the log tree, so during log replay overwrite_item() sees that the\ngeneration is 0 and i_size is 0 so we skip updating the inode's i_size\nfrom 64K to 0.\n\nFix this by making sure at fill_inode_item() we always log the real\ngeneration of the inode if it was logged in the current transaction with\nthe i_size we logged before. Also if an inode created in a previous\ntransaction is logged in exists mode only, make sure we log the i_size\nstored in the inode item located from the commit root, so that if we log\nmultiple times that the inode exists we get the correct i_size.\n\nA test case for fstests will follow soon."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: corrige inode de tamaño cero con tamaño no cero después de la reproducción del registro\n\nAl registrar que un inode existe, como parte de registrar un nuevo nombre o registrar nuevas entradas de directorio para un directorio, siempre establecemos la generación del elemento inode registrado en 0. Esto es para señalar durante la reproducción del registro (en overwrite_item()), que no debemos establecer el i_size ya que solo registramos que un inode existe, por lo que el i_size del inode en el árbol del subvolumen debe preservarse (ya que cuando registramos nuevos nombres o que un inode existe, no registramos extensiones).\n\nEsto funciona bien excepto cuando ya hemos registrado un inode en modo completo o es la primera vez que registramos un inode creado en una transacción pasada, ese inode tiene un nuevo i_size de 0 y luego registramos un nuevo nombre para el inode (debido a un nuevo enlace duro o un cambio de nombre), en cuyo caso registramos un i_size de 0 para el inode y una generación de 0, lo que hace que el código de reproducción del registro no actualice el i_size del inode a 0 (en overwrite_item()).\n\nUn escenario de ejemplo:\n\n  mkdir /mnt/dir\n  xfs_io -f -c ’pwrite 0 64K’ /mnt/dir/foo\n\n  sync\n\n  xfs_io -c ’truncate 0’ -c ’fsync’ /mnt/dir/foo\n\n  ln /mnt/dir/foo /mnt/dir/bar\n\n  xfs_io -c ’fsync’ /mnt/dir\n\n  <falla de energía>\n\nDespués de la reproducción del registro, el archivo permanece con un tamaño de 64K. Esto se debe a que cuando registramos el inode por primera vez, al hacer fsync del archivo foo, registramos su i_size actual de 0, y luego, cuando creamos un enlace duro, volvemos a registrar el inode en modo de existencia (LOG_INODE_EXISTS) pero establecemos una generación de 0 para el elemento inode que agregamos al árbol de registro, por lo que durante la reproducción del registro overwrite_item() ve que la generación es 0 y el i_size es 0, por lo que omitimos actualizar el i_size del inode de 64K a 0.\n\nEsto se corrige asegurándonos de que en fill_inode_item() siempre registramos la generación real del inode si fue registrado en la transacción actual con el i_size que registramos antes. Además, si un inode creado en una transacción anterior se registra solo en modo de existencia, nos aseguramos de registrar el i_size almacenado en el elemento inode ubicado desde la raíz de commit, de modo que si registramos varias veces que el inode existe, obtenemos el i_size correcto.\n\nPronto seguirá un caso de prueba para fstests."}],"id":"CVE-2026-43118","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T10:16:25.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03e966b63df5b06790310c1faaf3e0cb43adea8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/126999610eddeb1de3b47680585f4bc9531dc7f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5254d4181add9dfaa5e3519edd71cc8f752b2f85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/91990732ec4ce5c09361d498c6d621f5a76ee1f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c939bfa67d221f75351a5bf2fc912e8125547b7e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fddb157536e67a055597f00a8b4922d5f5ed0826"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43119.json b/data/2026/CVE-2026-43119.json
index 8802e58d1b..2c0a5a4e27 100644
--- a/data/2026/CVE-2026-43119.json
+++ b/data/2026/CVE-2026-43119.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ff5855e8891e1e2490741366d087fd2fbcaabc4a","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"6e539907c0d11f514c5e0b049b27b04dff48a5b1","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"40734ce8efc34c4a0d0222855798c0dc14b65f2e","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"b6807cfc195ef99e1ac37b2e1e60df40295daa8c","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"status":"affected","version":"8603d49906b231bbcd9141db7d096fa1041bc379","versionType":"git"},{"status":"affected","version":"0e061885bfcd65ef5d09f154f3c3c3491cc7544a","versionType":"git"},{"status":"affected","version":"a3d50fb7ce931f08a2c6194fdc4c9a56c9ed4153","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.47","versionType":"semver"},{"lessThan":"5.1","status":"affected","version":"5.0.20","versionType":"semver"},{"lessThan":"5.2","status":"affected","version":"5.1.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A02C7C65-4552-4547-B8B4-46A1AD0890F3","versionEndExcluding":"6.12.83","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: annotate data-races around hdev->req_status\n\n__hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock:\n\n    hdev->req_status = HCI_REQ_PEND;\n\nHowever, several other functions read or write hdev->req_status without\nholding any lock:\n\n  - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue)\n  - hci_cmd_sync_complete() reads/writes from HCI event completion\n  - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write\n  - hci_abort_conn() reads in connection abort path\n\nSince __hci_cmd_sync_sk() runs on hdev->req_workqueue while\nhci_send_cmd_sync() runs on hdev->workqueue, these are different\nworkqueues that can execute concurrently on different CPUs. The plain\nC accesses constitute a data race.\n\nAdd READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses\nto hdev->req_status to prevent potential compiler optimizations that\ncould affect correctness (e.g., load fusing in the wait_event\ncondition or store reordering)."}],"id":"CVE-2026-43119","lastModified":"2026-11-06T16:18:23.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43119","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:43.636559Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.773","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40734ce8efc34c4a0d0222855798c0dc14b65f2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e539907c0d11f514c5e0b049b27b04dff48a5b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6807cfc195ef99e1ac37b2e1e60df40295daa8c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ff5855e8891e1e2490741366d087fd2fbcaabc4a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ff5855e8891e1e2490741366d087fd2fbcaabc4a","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"6e539907c0d11f514c5e0b049b27b04dff48a5b1","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"40734ce8efc34c4a0d0222855798c0dc14b65f2e","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"lessThan":"b6807cfc195ef99e1ac37b2e1e60df40295daa8c","status":"affected","version":"f80c5dad7b6467b884c445ffea45985793b4b2d0","versionType":"git"},{"status":"affected","version":"8603d49906b231bbcd9141db7d096fa1041bc379","versionType":"git"},{"status":"affected","version":"0e061885bfcd65ef5d09f154f3c3c3491cc7544a","versionType":"git"},{"status":"affected","version":"a3d50fb7ce931f08a2c6194fdc4c9a56c9ed4153","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.47","versionType":"semver"},{"lessThan":"5.1","status":"affected","version":"5.0.20","versionType":"semver"},{"lessThan":"5.2","status":"affected","version":"5.1.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/hci_conn.c","net/bluetooth/hci_core.c","net/bluetooth/hci_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A02C7C65-4552-4547-B8B4-46A1AD0890F3","versionEndExcluding":"6.12.83","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: annotate data-races around hdev->req_status\n\n__hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock:\n\n    hdev->req_status = HCI_REQ_PEND;\n\nHowever, several other functions read or write hdev->req_status without\nholding any lock:\n\n  - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue)\n  - hci_cmd_sync_complete() reads/writes from HCI event completion\n  - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write\n  - hci_abort_conn() reads in connection abort path\n\nSince __hci_cmd_sync_sk() runs on hdev->req_workqueue while\nhci_send_cmd_sync() runs on hdev->workqueue, these are different\nworkqueues that can execute concurrently on different CPUs. The plain\nC accesses constitute a data race.\n\nAdd READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses\nto hdev->req_status to prevent potential compiler optimizations that\ncould affect correctness (e.g., load fusing in the wait_event\ncondition or store reordering)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: hci_sync: anotar condiciones de carrera de datos alrededor de hdev  ->  req_status\n\n__hci_cmd_sync_sk() establece hdev  ->  req_status bajo hdev  ->  req_lock:\n\n    hdev  ->  req_status = HCI_REQ_PEND;\n\nSin embargo, varias otras funciones leen o escriben hdev  ->  req_status sin mantener ningún bloqueo:\n\n  - hci_send_cmd_sync() lee req_status en hci_cmd_work (workqueue)\n  - hci_cmd_sync_complete() lee/escribe desde la finalización del evento HCI\n  - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() leen/escriben\n  - hci_abort_conn() lee en la ruta de aborto de conexión\n\nDado que __hci_cmd_sync_sk() se ejecuta en hdev  ->  req_workqueue mientras que hci_send_cmd_sync() se ejecuta en hdev  ->  workqueue, estas son diferentes workqueues que pueden ejecutarse concurrentemente en diferentes CPUs. Los accesos C simples constituyen una condición de carrera de datos.\n\nAñadir anotaciones READ_ONCE()/WRITE_ONCE() en todos los accesos concurrentes a hdev  ->  req_status para prevenir posibles optimizaciones del compilador que podrían afectar la corrección (p. ej., fusión de cargas en la condición wait_event o reordenamiento de almacenamiento)."}],"id":"CVE-2026-43119","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43119","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:43.636559Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.773","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40734ce8efc34c4a0d0222855798c0dc14b65f2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e539907c0d11f514c5e0b049b27b04dff48a5b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6807cfc195ef99e1ac37b2e1e60df40295daa8c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ff5855e8891e1e2490741366d087fd2fbcaabc4a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43120.json b/data/2026/CVE-2026-43120.json
index 26475a447a..3e763ca1f6 100644
--- a/data/2026/CVE-2026-43120.json
+++ b/data/2026/CVE-2026-43120.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"62298a48f8b8788ad8b8464e6ffdf1ddebd2217e","status":"affected","version":"715fdb3b30541cc8180b7cdc6aa9f8c307afdf25","versionType":"git"},{"lessThan":"66964118f1f50ed85001c8fc9f7ab5bbdd021ee0","status":"affected","version":"5ac388db27c443dadfbb0b8b23fa7ccf429d901a","versionType":"git"},{"lessThan":"0f22c32141acdcda266b26cab2b830baf870f3e0","status":"affected","version":"5ac388db27c443dadfbb0b8b23fa7ccf429d901a","versionType":"git"},{"lessThan":"0c5d70bcb9d2275a1c8515a924016fcfeb4ab441","status":"affected","version":"5ac388db27c443dadfbb0b8b23fa7ccf429d901a","versionType":"git"},{"lessThan":"29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2","status":"affected","version":"5ac388db27c443dadfbb0b8b23fa7ccf429d901a","versionType":"git"},{"lessThan":"6.6.136","status":"affected","version":"6.6.120","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"47055228-C2D7-4465-A276-87525D39743D","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6.120","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr->region to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr->region to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")"}],"id":"CVE-2026-43120","lastModified":"2026-10-19T20:18:07.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:52.649635Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.913","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"62298a48f8b8788ad8b8464e6ffdf1ddebd2217e","status":"affected","version":"715fdb3b30541cc8180b7cdc6aa9f8c307afdf25","versionType":"git"},{"lessThan":"66964118f1f50ed85001c8fc9f7ab5bbdd021ee0","status":"affected","version":"5ac388db27c443dadfbb0b8b23fa7ccf429d901a","versionType":"git"},{"lessThan":"0f22c32141acdcda266b26cab2b830baf870f3e0","status":"affected","version":"5ac388db27c443dadfbb0b8b23fa7ccf429d901a","versionType":"git"},{"lessThan":"0c5d70bcb9d2275a1c8515a924016fcfeb4ab441","status":"affected","version":"5ac388db27c443dadfbb0b8b23fa7ccf429d901a","versionType":"git"},{"lessThan":"29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2","status":"affected","version":"5ac388db27c443dadfbb0b8b23fa7ccf429d901a","versionType":"git"},{"lessThan":"6.6.136","status":"affected","version":"6.6.120","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"47055228-C2D7-4465-A276-87525D39743D","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6.120","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr->region to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr->region to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/irdma: Solución para una doble liberación relacionada con rereg_user_mr\n\nSi IB_MR_REREG_TRANS se establece durante rereg_user_mr, el umem será liberado y se asignará uno nuevo en irdma_rereg_mr_trans. Si algún paso de irdma_rereg_mr_trans falla después de que el nuevo umem sea asignado, libera el umem, pero no establece iwmr  ->  region en NULL. El problema es que este fallo se propaga al usuario, quien luego llamará a ibv_dereg_mr (como debería). Entonces, la ruta de dereg_mr verá un umem no-NULL e intentará llamar a ib_umem_release de nuevo.\n\nSolucione esto estableciendo iwmr  ->  region en NULL después de ib_umem_release.\n\nCorregido: 5ac388db27c4 (’RDMA/irdma: Añadir soporte para volver a registrar una región de memoria’)"}],"id":"CVE-2026-43120","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:52.649635Z","version":"2.0.3"}}]},"published":"2026-05-06T10:16:25.913","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43121.json b/data/2026/CVE-2026-43121.json
index fbb7211515..69cd718601 100644
--- a/data/2026/CVE-2026-43121.json
+++ b/data/2026/CVE-2026-43121.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["io_uring/zcrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a94f096e28bfc7975163a6b80f1c8f323efe317a","status":"affected","version":"34a3e60821ab9f335a58d43a88cccdbefdebdec3","versionType":"git"},{"lessThan":"485dc691257b96e6d3bdc25b0eff2daadcc5c46c","status":"affected","version":"34a3e60821ab9f335a58d43a88cccdbefdebdec3","versionType":"git"},{"lessThan":"003049b1c4fb8aabb93febb7d1e49004f6ad653b","status":"affected","version":"34a3e60821ab9f335a58d43a88cccdbefdebdec3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["io_uring/zcrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC","versionEndExcluding":"6.18.16","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zcrx: fix user_ref race between scrub and refill paths\n\nThe io_zcrx_put_niov_uref() function uses a non-atomic\ncheck-then-decrement pattern (atomic_read followed by separate\natomic_dec) to manipulate user_refs. This is serialized against other\ncallers by rq_lock, but io_zcrx_scrub() modifies the same counter with\natomic_xchg() WITHOUT holding rq_lock.\n\nOn SMP systems, the following race exists:\n\n  CPU0 (refill, holds rq_lock)          CPU1 (scrub, no rq_lock)\n  put_niov_uref:\n    atomic_read(uref) - 1\n    // window opens\n                                        atomic_xchg(uref, 0) - 1\n                                        return_niov_freelist(niov) [PUSH #1]\n    // window closes\n    atomic_dec(uref) - wraps to -1\n    returns true\n    return_niov(niov)\n    return_niov_freelist(niov)           [PUSH #2: DOUBLE-FREE]\n\nThe same niov is pushed to the freelist twice, causing free_count to\nexceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds\nwrite (a u32 value) past the kvmalloc'd freelist array into the adjacent\nslab object.\n\nFix this by replacing the non-atomic read-then-dec in\nio_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically\ntests and decrements user_refs. This makes the operation safe against\nconcurrent atomic_xchg from scrub without requiring scrub to acquire\nrq_lock.\n\n[pavel: removed a warning and a comment]"}],"id":"CVE-2026-43121","lastModified":"2026-06-17T10:48:58.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:28.950","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/003049b1c4fb8aabb93febb7d1e49004f6ad653b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/485dc691257b96e6d3bdc25b0eff2daadcc5c46c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a94f096e28bfc7975163a6b80f1c8f323efe317a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["io_uring/zcrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a94f096e28bfc7975163a6b80f1c8f323efe317a","status":"affected","version":"34a3e60821ab9f335a58d43a88cccdbefdebdec3","versionType":"git"},{"lessThan":"485dc691257b96e6d3bdc25b0eff2daadcc5c46c","status":"affected","version":"34a3e60821ab9f335a58d43a88cccdbefdebdec3","versionType":"git"},{"lessThan":"003049b1c4fb8aabb93febb7d1e49004f6ad653b","status":"affected","version":"34a3e60821ab9f335a58d43a88cccdbefdebdec3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["io_uring/zcrx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC","versionEndExcluding":"6.18.16","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/zcrx: fix user_ref race between scrub and refill paths\n\nThe io_zcrx_put_niov_uref() function uses a non-atomic\ncheck-then-decrement pattern (atomic_read followed by separate\natomic_dec) to manipulate user_refs. This is serialized against other\ncallers by rq_lock, but io_zcrx_scrub() modifies the same counter with\natomic_xchg() WITHOUT holding rq_lock.\n\nOn SMP systems, the following race exists:\n\n  CPU0 (refill, holds rq_lock)          CPU1 (scrub, no rq_lock)\n  put_niov_uref:\n    atomic_read(uref) - 1\n    // window opens\n                                        atomic_xchg(uref, 0) - 1\n                                        return_niov_freelist(niov) [PUSH #1]\n    // window closes\n    atomic_dec(uref) - wraps to -1\n    returns true\n    return_niov(niov)\n    return_niov_freelist(niov)           [PUSH #2: DOUBLE-FREE]\n\nThe same niov is pushed to the freelist twice, causing free_count to\nexceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds\nwrite (a u32 value) past the kvmalloc'd freelist array into the adjacent\nslab object.\n\nFix this by replacing the non-atomic read-then-dec in\nio_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically\ntests and decrements user_refs. This makes the operation safe against\nconcurrent atomic_xchg from scrub without requiring scrub to acquire\nrq_lock.\n\n[pavel: removed a warning and a comment]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nio_uring/zcrx: solución para la condición de carrera de user_ref entre las rutas de scrub y refill\n\nLa función io_zcrx_put_niov_uref() utiliza un patrón no atómico de ’verificar-y-luego-decrementar’ (atomic_read seguido de un atomic_dec separado) para manipular los user_refs. Esto se serializa frente a otros llamadores mediante rq_lock, pero io_zcrx_scrub() modifica el mismo contador con atomic_xchg() SIN mantener rq_lock.\n\nEn sistemas SMP, existe la siguiente condición de carrera:\n\n  CPU0 (refill, mantiene rq_lock)          CPU1 (scrub, sin rq_lock)\n  put_niov_uref:\n    atomic_read(uref) - 1\n    // la ventana se abre\n                                        atomic_xchg(uref, 0) - 1\n                                        return_niov_freelist(niov) [PUSH #1]\n    // la ventana se cierra\n    atomic_dec(uref) - se envuelve a -1\n    devuelve verdadero\n    return_niov(niov)\n    return_niov_freelist(niov)           [PUSH #2: DOBLE LIBERACIÓN]\n\nEl mismo niov se empuja a la freelist dos veces, haciendo que free_count exceda nr_iovs. Los empujes subsiguientes a la freelist luego realizan una escritura fuera de límites (un valor u32) más allá del array de freelist asignado con kvmalloc hacia el objeto slab adyacente.\n\nSolucione esto reemplazando la lectura-y-luego-decremento no atómica en io_zcrx_put_niov_uref() con un bucle atomic_try_cmpxchg que prueba y decrementa atómicamente los user_refs. Esto hace que la operación sea segura contra atomic_xchg concurrente de scrub sin requerir que scrub adquiera rq_lock.\n\n[pavel: se eliminó una advertencia y un comentario]"}],"id":"CVE-2026-43121","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:28.950","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/003049b1c4fb8aabb93febb7d1e49004f6ad653b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/485dc691257b96e6d3bdc25b0eff2daadcc5c46c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a94f096e28bfc7975163a6b80f1c8f323efe317a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43123.json b/data/2026/CVE-2026-43123.json
index 006cc9e5c4..6ac33bd8c0 100644
--- a/data/2026/CVE-2026-43123.json
+++ b/data/2026/CVE-2026-43123.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/video/fbdev/core/fbcon.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d3e535533767c85788529e626478718b7e95a59f","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"3b5a754ec86bc6064af9aca76eb191c2405e6b0c","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"a785c4e2a999c2d51dfcf40d317cfb30cc735d2c","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"11a93180a70bb3095a9bd80d113d9277e30d9959","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"f57b61624c86ef8f87f6e6b7dd0755de03d90e89","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"011a0502801c8536f64141a2b61362c14f456544","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/video/fbdev/core/fbcon.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.23"},{"lessThan":"2.6.23","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67E17AC6-4F6C-4B24-9825-9C2DE3794E62","versionEndExcluding":"5.15.203","versionStartIncluding":"2.6.23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: check return value of con2fb_acquire_newinfo()\n\nIf fbcon_open() fails when called from con2fb_acquire_newinfo() then\ninfo->fbcon_par pointer remains NULL which is later dereferenced.\n\nAdd check for return value of the function con2fb_acquire_newinfo() to\navoid it.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."}],"id":"CVE-2026-43123","lastModified":"2026-11-06T16:18:23.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43123","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:47.782222Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.180","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/video/fbdev/core/fbcon.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d3e535533767c85788529e626478718b7e95a59f","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"3b5a754ec86bc6064af9aca76eb191c2405e6b0c","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"a785c4e2a999c2d51dfcf40d317cfb30cc735d2c","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"11a93180a70bb3095a9bd80d113d9277e30d9959","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"f57b61624c86ef8f87f6e6b7dd0755de03d90e89","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"},{"lessThan":"011a0502801c8536f64141a2b61362c14f456544","status":"affected","version":"d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/video/fbdev/core/fbcon.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.23"},{"lessThan":"2.6.23","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67E17AC6-4F6C-4B24-9825-9C2DE3794E62","versionEndExcluding":"5.15.203","versionStartIncluding":"2.6.23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: check return value of con2fb_acquire_newinfo()\n\nIf fbcon_open() fails when called from con2fb_acquire_newinfo() then\ninfo->fbcon_par pointer remains NULL which is later dereferenced.\n\nAdd check for return value of the function con2fb_acquire_newinfo() to\navoid it.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfbcon: comprobar el valor de retorno de con2fb_acquire_newinfo()\n\nSi fbcon_open() falla cuando se llama desde con2fb_acquire_newinfo(), entonces el puntero info  ->  fbcon_par permanece NULL, el cual es desreferenciado posteriormente.\n\nAñadir una comprobación para el valor de retorno de la función con2fb_acquire_newinfo() para evitarlo.\n\nEncontrado por Linux Verification Center (linuxtesting.org) con SVACE."}],"id":"CVE-2026-43123","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43123","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:47.782222Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.180","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43124.json b/data/2026/CVE-2026-43124.json
index 5441a70e14..10ed438ac9 100644
--- a/data/2026/CVE-2026-43124.json
+++ b/data/2026/CVE-2026-43124.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/pstore/ram_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d47234840aeb4182ed3ee795c578b1dfa9cbd25b","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"49918dd52615097529811d21ec6074dd02ebe77c","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"8baa234181f632cabacf73e4834a910859e9fcc9","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"1da904e84de608907662ad8a51ba9c571d61e003","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"8d849adfbc3e98417fb541620568db1a759ef441","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"2c99326dc1c79b7ce3c8dd92929b5ce724ff70eb","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"88d5b28f63c7aac1271784e3b800ed405d1cde75","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"05363abc7625cf18c96e67f50673cd07f11da5e9","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"status":"affected","version":"9095f19baae92afb978f8df77d19280fe291b337","versionType":"git"},{"status":"affected","version":"36a9916189b46b78dbf4fa542739b464444f0537","versionType":"git"},{"status":"affected","version":"1cd01dba1355e291f636555b1920625ed58c1623","versionType":"git"},{"status":"affected","version":"7026e2457c5b0c0e8a81e65a8209b8420a437b4d","versionType":"git"},{"status":"affected","version":"1e5b387747ba285a64348b9a96b246d0b9d52b03","versionType":"git"},{"status":"affected","version":"d0028f48b33086cf6d8f87831a650866107b5785","versionType":"git"},{"lessThan":"3.17","status":"affected","version":"3.16.62","versionType":"semver"},{"lessThan":"3.19","status":"affected","version":"3.18.123","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.158","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.129","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.72","versionType":"semver"},{"lessThan":"4.19","status":"affected","version":"4.18.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/pstore/ram_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"60A2158E-664E-490E-AC28-0DFD1C0680CA","versionEndExcluding":"5.10.252","versionStartIncluding":"3.16.62","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npstore: ram_core: fix incorrect success return when vmap() fails\n\nIn persistent_ram_vmap(), vmap() may return NULL on failure.\n\nIf offset is non-zero, adding offset_in_page(start) causes the function\nto return a non-NULL pointer even though the mapping failed.\npersistent_ram_buffer_map() therefore incorrectly returns success.\n\nSubsequent access to prz->buffer may dereference an invalid address\nand cause crashes.\n\nAdd proper NULL checking for vmap() failures."}],"id":"CVE-2026-43124","lastModified":"2026-11-06T16:18:23.357","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43124","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:51.783666Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.313","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/05363abc7625cf18c96e67f50673cd07f11da5e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1da904e84de608907662ad8a51ba9c571d61e003"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c99326dc1c79b7ce3c8dd92929b5ce724ff70eb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49918dd52615097529811d21ec6074dd02ebe77c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/88d5b28f63c7aac1271784e3b800ed405d1cde75"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8baa234181f632cabacf73e4834a910859e9fcc9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d849adfbc3e98417fb541620568db1a759ef441"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d47234840aeb4182ed3ee795c578b1dfa9cbd25b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/pstore/ram_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d47234840aeb4182ed3ee795c578b1dfa9cbd25b","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"49918dd52615097529811d21ec6074dd02ebe77c","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"8baa234181f632cabacf73e4834a910859e9fcc9","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"1da904e84de608907662ad8a51ba9c571d61e003","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"8d849adfbc3e98417fb541620568db1a759ef441","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"2c99326dc1c79b7ce3c8dd92929b5ce724ff70eb","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"88d5b28f63c7aac1271784e3b800ed405d1cde75","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"lessThan":"05363abc7625cf18c96e67f50673cd07f11da5e9","status":"affected","version":"831b624df1b420c8f9281ed1307a8db23afb72df","versionType":"git"},{"status":"affected","version":"9095f19baae92afb978f8df77d19280fe291b337","versionType":"git"},{"status":"affected","version":"36a9916189b46b78dbf4fa542739b464444f0537","versionType":"git"},{"status":"affected","version":"1cd01dba1355e291f636555b1920625ed58c1623","versionType":"git"},{"status":"affected","version":"7026e2457c5b0c0e8a81e65a8209b8420a437b4d","versionType":"git"},{"status":"affected","version":"1e5b387747ba285a64348b9a96b246d0b9d52b03","versionType":"git"},{"status":"affected","version":"d0028f48b33086cf6d8f87831a650866107b5785","versionType":"git"},{"lessThan":"3.17","status":"affected","version":"3.16.62","versionType":"semver"},{"lessThan":"3.19","status":"affected","version":"3.18.123","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.158","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.129","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.72","versionType":"semver"},{"lessThan":"4.19","status":"affected","version":"4.18.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/pstore/ram_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"60A2158E-664E-490E-AC28-0DFD1C0680CA","versionEndExcluding":"5.10.252","versionStartIncluding":"3.16.62","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npstore: ram_core: fix incorrect success return when vmap() fails\n\nIn persistent_ram_vmap(), vmap() may return NULL on failure.\n\nIf offset is non-zero, adding offset_in_page(start) causes the function\nto return a non-NULL pointer even though the mapping failed.\npersistent_ram_buffer_map() therefore incorrectly returns success.\n\nSubsequent access to prz->buffer may dereference an invalid address\nand cause crashes.\n\nAdd proper NULL checking for vmap() failures."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npstore: ram_core: corregir el retorno de éxito incorrecto cuando vmap() falla\n\nEn persistent_ram_vmap(), vmap() puede devolver NULL en caso de fallo.\n\nSi el offset no es cero, añadir offset_in_page(start) hace que la función devuelva un puntero no-NULL aunque el mapeo falló. persistent_ram_buffer_map() por lo tanto devuelve éxito incorrectamente.\n\nEl acceso subsiguiente a prz  ->  buffer puede desreferenciar una dirección inválida y causar fallos.\n\nAñadir una comprobación de NULL adecuada para los fallos de vmap()."}],"id":"CVE-2026-43124","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43124","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:51.783666Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.313","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/05363abc7625cf18c96e67f50673cd07f11da5e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1da904e84de608907662ad8a51ba9c571d61e003"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c99326dc1c79b7ce3c8dd92929b5ce724ff70eb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49918dd52615097529811d21ec6074dd02ebe77c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/88d5b28f63c7aac1271784e3b800ed405d1cde75"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8baa234181f632cabacf73e4834a910859e9fcc9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d849adfbc3e98417fb541620568db1a759ef441"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d47234840aeb4182ed3ee795c578b1dfa9cbd25b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43125.json b/data/2026/CVE-2026-43125.json
index 48d02a36a9..8230aef313 100644
--- a/data/2026/CVE-2026-43125.json
+++ b/data/2026/CVE-2026-43125.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/dlm/lock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0270664871616eb3a5c864b9aa17be76fd35b920","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"c98d071a1ca903b705316225e47006aaa20e989c","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"2deafd015ea9a0e75ee5764e20eb1e16bd73efd8","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"67288113c5e6cf9e659b4065c0ed6f16100e0c71","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"082083c9fbd99422a0370fe2102144a231c9f5d6","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"5f053a2e7209d326cbbc07738fa6d6893d307438","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"080e5563f878c64e697b89e7439d730d0daad882","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/dlm/lock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.4"},{"lessThan":"3.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_extras_rt_els:7"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.10.0-1160.155.1.rt56.1307.el7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.10.0-1160.154.1.el7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.132.1.rt7.473.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.132.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.198.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus_long_life:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.198.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.150.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.150.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.15.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.178.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.178.1.rt14.463.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.136.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.125.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unknown","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"29152BBE-96F9-4D35-A99C-E61CF2C0DDEB","versionEndExcluding":"6.12.75","versionStartIncluding":"3.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: validate length in dlm_search_rsb_tree\n\nThe len parameter in dlm_dump_rsb_name() is not validated and comes\nfrom network messages. When it exceeds DLM_RESNAME_MAXLEN, it can\ncause out-of-bounds write in dlm_search_rsb_tree().\n\nAdd length validation to prevent potential buffer overflow."}],"id":"CVE-2026-43125","lastModified":"2026-10-30T13:18:46.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43125","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:54.896196Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.450","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0270664871616eb3a5c864b9aa17be76fd35b920"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2deafd015ea9a0e75ee5764e20eb1e16bd73efd8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c98d071a1ca903b705316225e47006aaa20e989c"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25120"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25121"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25217"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:33899"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:33900"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:34094"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:34095"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:35844"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:35863"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36767"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:41236"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55761"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55762"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55763"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55837"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:56224"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:56225"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59091"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43125"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467234"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43125.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-130"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/dlm/lock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0270664871616eb3a5c864b9aa17be76fd35b920","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"c98d071a1ca903b705316225e47006aaa20e989c","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"2deafd015ea9a0e75ee5764e20eb1e16bd73efd8","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"67288113c5e6cf9e659b4065c0ed6f16100e0c71","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"082083c9fbd99422a0370fe2102144a231c9f5d6","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"5f053a2e7209d326cbbc07738fa6d6893d307438","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"},{"lessThan":"080e5563f878c64e697b89e7439d730d0daad882","status":"affected","version":"7210cb7a72a22303cdb225bd1aea28697a17bbae","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/dlm/lock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.4"},{"lessThan":"3.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_extras_rt_els:7"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.10.0-1160.155.1.rt56.1307.el7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.10.0-1160.154.1.el7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.132.1.rt7.473.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.132.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.198.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus_long_life:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.198.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.150.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.150.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.15.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.178.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.178.1.rt14.463.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.136.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.125.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unknown","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"29152BBE-96F9-4D35-A99C-E61CF2C0DDEB","versionEndExcluding":"6.12.75","versionStartIncluding":"3.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: validate length in dlm_search_rsb_tree\n\nThe len parameter in dlm_dump_rsb_name() is not validated and comes\nfrom network messages. When it exceeds DLM_RESNAME_MAXLEN, it can\ncause out-of-bounds write in dlm_search_rsb_tree().\n\nAdd length validation to prevent potential buffer overflow."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndlm: validar la longitud en dlm_search_rsb_tree\n\nEl parámetro len en dlm_dump_rsb_name() no está validado y proviene\nde mensajes de red. Cuando excede DLM_RESNAME_MAXLEN, puede\ncausar una escritura fuera de límites en dlm_search_rsb_tree().\n\nAñadir validación de longitud para prevenir un potencial desbordamiento de búfer."}],"id":"CVE-2026-43125","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43125","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:54.896196Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.450","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0270664871616eb3a5c864b9aa17be76fd35b920"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2deafd015ea9a0e75ee5764e20eb1e16bd73efd8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c98d071a1ca903b705316225e47006aaa20e989c"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25120"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25121"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25217"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:33899"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:33900"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:34094"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:34095"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:35844"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:35863"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36767"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:41236"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55761"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55762"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55763"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55837"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:56224"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:56225"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:59091"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43125"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467234"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43125.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-130"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43126.json b/data/2026/CVE-2026-43126.json
index 0afaaa1418..308a917c00 100644
--- a/data/2026/CVE-2026-43126.json
+++ b/data/2026/CVE-2026-43126.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/core/oss/mixer_oss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"11ecfba92bdb420456a48da45a756b24d6356f72","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"20c52a70414095447da1be076f492cc7a6dce7cf","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ae583f113d15fa97e5234133c20d09f8e6214e47","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"e6645e625480cdf1079a4265f758d13b70721029","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8c097cf736993454acf3f711a3b376d6c7ad8965","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"084d5d44418148662365eced3e126ad1a81ee3e2","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/core/oss/mixer_oss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"29679A93-33A1-4349-A8F1-5CC7D69D3797","versionEndExcluding":"6.12.75","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mixer: oss: Add card disconnect checkpoints\n\nALSA OSS mixer layer calls the kcontrol ops rather individually, and\npending calls might be not always caught at disconnecting the device.\n\nFor avoiding the potential UAF scenarios, add sanity checks of the\ncard disconnection at each entry point of OSS mixer accesses.  The\nrwsem is taken just before that check, hence the rest context should\nbe covered by that properly."}],"id":"CVE-2026-43126","lastModified":"2026-10-30T13:18:46.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T12:16:29.597","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/11ecfba92bdb420456a48da45a756b24d6356f72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20c52a70414095447da1be076f492cc7a6dce7cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c097cf736993454acf3f711a3b376d6c7ad8965"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae583f113d15fa97e5234133c20d09f8e6214e47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6645e625480cdf1079a4265f758d13b70721029"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/core/oss/mixer_oss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"11ecfba92bdb420456a48da45a756b24d6356f72","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"20c52a70414095447da1be076f492cc7a6dce7cf","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ae583f113d15fa97e5234133c20d09f8e6214e47","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"e6645e625480cdf1079a4265f758d13b70721029","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8c097cf736993454acf3f711a3b376d6c7ad8965","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"084d5d44418148662365eced3e126ad1a81ee3e2","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/core/oss/mixer_oss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"29679A93-33A1-4349-A8F1-5CC7D69D3797","versionEndExcluding":"6.12.75","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mixer: oss: Add card disconnect checkpoints\n\nALSA OSS mixer layer calls the kcontrol ops rather individually, and\npending calls might be not always caught at disconnecting the device.\n\nFor avoiding the potential UAF scenarios, add sanity checks of the\ncard disconnection at each entry point of OSS mixer accesses.  The\nrwsem is taken just before that check, hence the rest context should\nbe covered by that properly."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: mixer: oss: Añadir puntos de control de desconexión de tarjeta\n\nLa capa del mezclador ALSA OSS llama a las operaciones de kcontrol de forma bastante individual, y las llamadas pendientes podrían no ser siempre detectadas al desconectar el dispositivo.\n\nPara evitar los posibles escenarios UAF, añadir verificaciones de integridad de la desconexión de la tarjeta en cada punto de entrada de los accesos al mezclador OSS. El rwsem se toma justo antes de esa comprobación, por lo tanto, el resto del contexto debería quedar cubierto por ello adecuadamente."}],"id":"CVE-2026-43126","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-05-06T12:16:29.597","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/084d5d44418148662365eced3e126ad1a81ee3e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/11ecfba92bdb420456a48da45a756b24d6356f72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20c52a70414095447da1be076f492cc7a6dce7cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c097cf736993454acf3f711a3b376d6c7ad8965"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae583f113d15fa97e5234133c20d09f8e6214e47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6645e625480cdf1079a4265f758d13b70721029"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43127.json b/data/2026/CVE-2026-43127.json
index a632907cef..3857f2535e 100644
--- a/data/2026/CVE-2026-43127.json
+++ b/data/2026/CVE-2026-43127.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs3/run.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d60f09d2d16c44a797d8cb67015cde2508720506","status":"affected","version":"57f7979aefdcef66326bda47e07ee0d8be64bf21","versionType":"git"},{"lessThan":"76016d15bbd90caa0ce7765fddf9bde8e943e601","status":"affected","version":"db7fc56646cafe39599a4c21f1398e2bdfd5c185","versionType":"git"},{"lessThan":"b014372b62237521444ee51384549bdf48b79015","status":"affected","version":"5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36","versionType":"git"},{"lessThan":"b8d22d9d8260b0f4f4d8e2898c98037c9982ea66","status":"affected","version":"5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36","versionType":"git"},{"lessThan":"08ce2fee1b869ecbfbd94e0eb2630e52203a2e03","status":"affected","version":"5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36","versionType":"git"},{"lessThan":"6.6.160","status":"affected","version":"6.6.66","versionType":"semver"},{"lessThan":"6.12.114","status":"affected","version":"6.12.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs3/run.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C8B0BDB8-5231-48C2-9E23-019AE9ADD6EF","versionEndExcluding":"6.18.16","versionStartIncluding":"6.6.66","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix circular locking dependency in run_unpack_ex\n\nSyzbot reported a circular locking dependency between wnd->rw_lock\n(sbi->used.bitmap) and ni->file.run_lock.\n\nThe deadlock scenario:\n1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock.\n2. run_unpack_ex() takes wnd->rw_lock then tries to acquire\n   ni->file.run_lock inside ntfs_refresh_zone().\n\nThis creates an AB-BA deadlock.\n\nFix this by using down_read_trylock() instead of down_read() when\nacquiring run_lock in run_unpack_ex(). If the lock is contended,\nskip ntfs_refresh_zone() - the MFT zone will be refreshed on the\nnext MFT operation. This breaks the circular dependency since we\nnever block waiting for run_lock while holding wnd->rw_lock."}],"id":"CVE-2026-43127","lastModified":"2026-10-21T13:18:50.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:29.727","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08ce2fee1b869ecbfbd94e0eb2630e52203a2e03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/76016d15bbd90caa0ce7765fddf9bde8e943e601"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b014372b62237521444ee51384549bdf48b79015"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8d22d9d8260b0f4f4d8e2898c98037c9982ea66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d60f09d2d16c44a797d8cb67015cde2508720506"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs3/run.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d60f09d2d16c44a797d8cb67015cde2508720506","status":"affected","version":"57f7979aefdcef66326bda47e07ee0d8be64bf21","versionType":"git"},{"lessThan":"76016d15bbd90caa0ce7765fddf9bde8e943e601","status":"affected","version":"db7fc56646cafe39599a4c21f1398e2bdfd5c185","versionType":"git"},{"lessThan":"b014372b62237521444ee51384549bdf48b79015","status":"affected","version":"5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36","versionType":"git"},{"lessThan":"b8d22d9d8260b0f4f4d8e2898c98037c9982ea66","status":"affected","version":"5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36","versionType":"git"},{"lessThan":"08ce2fee1b869ecbfbd94e0eb2630e52203a2e03","status":"affected","version":"5fc982fe7eca9d0cf7b25832450ebd4f7c8e1c36","versionType":"git"},{"lessThan":"6.6.160","status":"affected","version":"6.6.66","versionType":"semver"},{"lessThan":"6.12.114","status":"affected","version":"6.12.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs3/run.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C8B0BDB8-5231-48C2-9E23-019AE9ADD6EF","versionEndExcluding":"6.18.16","versionStartIncluding":"6.6.66","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix circular locking dependency in run_unpack_ex\n\nSyzbot reported a circular locking dependency between wnd->rw_lock\n(sbi->used.bitmap) and ni->file.run_lock.\n\nThe deadlock scenario:\n1. ntfs_extend_mft() takes ni->file.run_lock then wnd->rw_lock.\n2. run_unpack_ex() takes wnd->rw_lock then tries to acquire\n   ni->file.run_lock inside ntfs_refresh_zone().\n\nThis creates an AB-BA deadlock.\n\nFix this by using down_read_trylock() instead of down_read() when\nacquiring run_lock in run_unpack_ex(). If the lock is contended,\nskip ntfs_refresh_zone() - the MFT zone will be refreshed on the\nnext MFT operation. This breaks the circular dependency since we\nnever block waiting for run_lock while holding wnd->rw_lock."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nntfs3: corrige la dependencia de bloqueo circular en run_unpack_ex\n\nSyzbot informó una dependencia de bloqueo circular entre wnd  ->  rw_lock (sbi  ->  used.bitmap) y ni  ->  file.run_lock.\n\nEl escenario de interbloqueo:\n1. ntfs_extend_mft() toma ni  ->  file.run_lock y luego wnd  ->  rw_lock.\n2. run_unpack_ex() toma wnd  ->  rw_lock y luego intenta adquirir ni  ->  file.run_lock dentro de ntfs_refresh_zone().\n\nEsto crea un interbloqueo AB-BA.\n\nSolucione esto usando down_read_trylock() en lugar de down_read() al adquirir run_lock en run_unpack_ex(). Si el bloqueo está en contención, omita ntfs_refresh_zone() - la zona MFT se actualizará en la siguiente operación MFT. Esto rompe la dependencia circular ya que nunca nos bloqueamos esperando run_lock mientras mantenemos wnd  ->  rw_lock."}],"id":"CVE-2026-43127","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:29.727","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08ce2fee1b869ecbfbd94e0eb2630e52203a2e03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/76016d15bbd90caa0ce7765fddf9bde8e943e601"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b014372b62237521444ee51384549bdf48b79015"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8d22d9d8260b0f4f4d8e2898c98037c9982ea66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d60f09d2d16c44a797d8cb67015cde2508720506"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43128.json b/data/2026/CVE-2026-43128.json
index f6132cab67..0868747e25 100644
--- a/data/2026/CVE-2026-43128.json
+++ b/data/2026/CVE-2026-43128.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/core/umem_dmabuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70542b69abff34d24b11ae0bb200cc7a766d18df","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"b324327ff6f48d8065dca67eb3b91357e72726bd","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"ba3bf0f1bf1d5d0404678485e872980532fcc2c4","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"40126bcbefa79ea86672e05dae608596bab38319","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"104016eb671e19709721c1b0048dd912dc2e96be","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/core/umem_dmabuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix double dma_buf_unpin in failure path\n\nIn ib_umem_dmabuf_get_pinned_with_dma_device(), the call to\nib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf\nis immediately unpinned but the umem_dmabuf->pinned flag is still\nset. Then, when ib_umem_release() is called, it calls\nib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.\n\nFix this by removing the immediate unpin upon failure and just let\nthe ib_umem_release/revoke path handle it. This also ensures the\nproper unmap-unpin unwind ordering if the dmabuf_map_pages call\nhappened to fail due to dma_resv_wait_timeout (and therefore has\na non-NULL umem_dmabuf->sgt)."}],"id":"CVE-2026-43128","lastModified":"2026-10-19T20:18:07.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43128","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:57.128797Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.837","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/core/umem_dmabuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70542b69abff34d24b11ae0bb200cc7a766d18df","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"b324327ff6f48d8065dca67eb3b91357e72726bd","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"ba3bf0f1bf1d5d0404678485e872980532fcc2c4","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"40126bcbefa79ea86672e05dae608596bab38319","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"},{"lessThan":"104016eb671e19709721c1b0048dd912dc2e96be","status":"affected","version":"1e4df4a21c5ac722df1099eee30cad9246c889b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/core/umem_dmabuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix double dma_buf_unpin in failure path\n\nIn ib_umem_dmabuf_get_pinned_with_dma_device(), the call to\nib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf\nis immediately unpinned but the umem_dmabuf->pinned flag is still\nset. Then, when ib_umem_release() is called, it calls\nib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.\n\nFix this by removing the immediate unpin upon failure and just let\nthe ib_umem_release/revoke path handle it. This also ensures the\nproper unmap-unpin unwind ordering if the dmabuf_map_pages call\nhappened to fail due to dma_resv_wait_timeout (and therefore has\na non-NULL umem_dmabuf->sgt)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/umem: Corrección de doble dma_buf_unpin en la ruta de fallo\n\nEn ib_umem_dmabuf_get_pinned_with_dma_device(), la llamada a ib_umem_dmabuf_map_pages() puede fallar. Si esto ocurre, el dmabuf se desancla inmediatamente, pero el flag umem_dmabuf  ->  pinned sigue establecido. Luego, cuando se llama a ib_umem_release(), esta llama a ib_umem_dmabuf_revoke(), que volverá a llamar a dma_buf_unpin().\n\nEsto se soluciona eliminando el desanclaje inmediato en caso de fallo y simplemente dejando que la ruta ib_umem_release/revoke lo gestione. Esto también asegura el orden de desenrollado adecuado de desmapeo-desanclaje si la llamada a dmabuf_map_pages llegara a fallar debido a dma_resv_wait_timeout (y por lo tanto tiene un umem_dmabuf  ->  sgt no nulo)."}],"id":"CVE-2026-43128","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43128","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:57.128797Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.837","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43129.json b/data/2026/CVE-2026-43129.json
index cf87cdff35..68d55cc59b 100644
--- a/data/2026/CVE-2026-43129.json
+++ b/data/2026/CVE-2026-43129.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/ima.h","security/integrity/ima/ima_kexec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5bfa1941ec40d5bed68f3e3f22ea13aff9c6d67a","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"43308106a1762b72f3b20a44b75b2df5cb25b77b","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"f11d7d088f5ed54b31c6735854c12845eb60eb4a","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"9e1f51c1ad57cc76a0e8b5eb27038f8973fff4fa","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"5366ec7d2f793ce703c403d7fd4c25a3db365b9d","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"10d1c75ed4382a8e79874379caa2ead8952734f9","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/ima.h","security/integrity/ima/ima_kexec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.77","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"08247D85-C56B-439D-A2E8-1570C7CF83AC","versionEndExcluding":"6.12.77","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nima: verify the previous kernel's IMA buffer lies in addressable RAM\n\nPatch series \"Address page fault in ima_restore_measurement_list()\", v3.\n\nWhen the second-stage kernel is booted via kexec with a limiting command\nline such as \"mem=<size>\" we observe a pafe fault that happens.\n\n    BUG: unable to handle page fault for address: ffff97793ff47000\n    RIP: ima_restore_measurement_list+0xdc/0x45a\n    #PF: error_code(0x0000)  not-present page\n\nThis happens on x86_64 only, as this is already fixed in aarch64 in\ncommit: cbf9c4b9617b (\"of: check previous kernel's ima-kexec-buffer\nagainst memory bounds\")\n\n\nThis patch (of 3):\n\nWhen the second-stage kernel is booted with a limiting command line (e.g. \n\"mem=<size>\"), the IMA measurement buffer handed over from the previous\nkernel may fall outside the addressable RAM of the new kernel.  Accessing\nsuch a buffer can fault during early restore.\n\nIntroduce a small generic helper, ima_validate_range(), which verifies\nthat a physical [start, end] range for the previous-kernel IMA buffer lies\nwithin addressable memory:\n\t- On x86, use pfn_range_is_mapped().\n\t- On OF based architectures, use page_is_ram()."}],"id":"CVE-2026-43129","lastModified":"2026-11-06T16:18:23.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43129","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:55.858457Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.963","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10d1c75ed4382a8e79874379caa2ead8952734f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/43308106a1762b72f3b20a44b75b2df5cb25b77b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5366ec7d2f793ce703c403d7fd4c25a3db365b9d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5bfa1941ec40d5bed68f3e3f22ea13aff9c6d67a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e1f51c1ad57cc76a0e8b5eb27038f8973fff4fa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f11d7d088f5ed54b31c6735854c12845eb60eb4a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/ima.h","security/integrity/ima/ima_kexec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5bfa1941ec40d5bed68f3e3f22ea13aff9c6d67a","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"43308106a1762b72f3b20a44b75b2df5cb25b77b","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"f11d7d088f5ed54b31c6735854c12845eb60eb4a","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"9e1f51c1ad57cc76a0e8b5eb27038f8973fff4fa","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"5366ec7d2f793ce703c403d7fd4c25a3db365b9d","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"},{"lessThan":"10d1c75ed4382a8e79874379caa2ead8952734f9","status":"affected","version":"b69a2afd5afce9bf6d56e349d6ab592c916e20f2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/ima.h","security/integrity/ima/ima_kexec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.77","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"08247D85-C56B-439D-A2E8-1570C7CF83AC","versionEndExcluding":"6.12.77","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nima: verify the previous kernel's IMA buffer lies in addressable RAM\n\nPatch series \"Address page fault in ima_restore_measurement_list()\", v3.\n\nWhen the second-stage kernel is booted via kexec with a limiting command\nline such as \"mem=<size>\" we observe a pafe fault that happens.\n\n    BUG: unable to handle page fault for address: ffff97793ff47000\n    RIP: ima_restore_measurement_list+0xdc/0x45a\n    #PF: error_code(0x0000)  not-present page\n\nThis happens on x86_64 only, as this is already fixed in aarch64 in\ncommit: cbf9c4b9617b (\"of: check previous kernel's ima-kexec-buffer\nagainst memory bounds\")\n\n\nThis patch (of 3):\n\nWhen the second-stage kernel is booted with a limiting command line (e.g. \n\"mem=<size>\"), the IMA measurement buffer handed over from the previous\nkernel may fall outside the addressable RAM of the new kernel.  Accessing\nsuch a buffer can fault during early restore.\n\nIntroduce a small generic helper, ima_validate_range(), which verifies\nthat a physical [start, end] range for the previous-kernel IMA buffer lies\nwithin addressable memory:\n\t- On x86, use pfn_range_is_mapped().\n\t- On OF based architectures, use page_is_ram()."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nima: verificar que el búfer IMA del kernel anterior se encuentre en RAM direccionable\n\nSerie de parches ’Address page fault in ima_restore_measurement_list()’, v3.\n\nCuando el kernel de segunda etapa se inicia a través de kexec con una línea de comandos limitante como ’mem=[size]’, observamos una falla de página que ocurre.\n\n    BUG: no se puede manejar la falla de página para la dirección: ffff97793ff47000\n    RIP: ima_restore_measurement_list+0xdc/0x45a\n    #PF: error_code(0x 0000) página no presente\n\nEsto ocurre solo en x86_64, ya que esto ya está corregido en aarch64 en el commit: cbf9c4b9617b (’of: check previous kernel’s ima-kexec-buffer against memory bounds’)\n\nEste parche (de 3):\n\nCuando el kernel de segunda etapa se inicia con una línea de comandos limitante (p. ej., ’mem=[size]’), el búfer de medición IMA entregado por el kernel anterior puede quedar fuera de la RAM direccionable del nuevo kernel. Acceder a dicho búfer puede causar una falla durante la restauración temprana.\n\nSe introduce una pequeña función auxiliar genérica, ima_validate_range(), que verifica que un rango físico [inicio, fin] para el búfer IMA del kernel anterior se encuentre dentro de la memoria direccionable:\n\t- En x86, usar pfn_range_is_mapped().\n\t- En arquitecturas basadas en OF, usar page_is_ram()."}],"id":"CVE-2026-43129","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43129","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:28:55.858457Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:29.963","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10d1c75ed4382a8e79874379caa2ead8952734f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/43308106a1762b72f3b20a44b75b2df5cb25b77b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5366ec7d2f793ce703c403d7fd4c25a3db365b9d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5bfa1941ec40d5bed68f3e3f22ea13aff9c6d67a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e1f51c1ad57cc76a0e8b5eb27038f8973fff4fa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f11d7d088f5ed54b31c6735854c12845eb60eb4a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43130.json b/data/2026/CVE-2026-43130.json
index 709af3392e..05c2d53be1 100644
--- a/data/2026/CVE-2026-43130.json
+++ b/data/2026/CVE-2026-43130.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iommu/intel/pasid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"581ce094d9eafb78ec4f9de77bd24b780c151236","status":"affected","version":"f873b85ec762c5a6abe94a7ddb31df5d3ba07d85","versionType":"git"},{"lessThan":"e2c78c69f8faf2885ea4ceee08c71ac738f401a0","status":"affected","version":"d70f1c85113cd8c2aa8373f491ca5d1b22ec0554","versionType":"git"},{"lessThan":"ead67d0378e90f419e385a43af29435242d80c12","status":"affected","version":"34a7b30f56d30114bf4d436e4dc793afe326fbcf","versionType":"git"},{"lessThan":"01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d","status":"affected","version":"2b74b2a92e524d7c8dec8e02e95ecf18b667c062","versionType":"git"},{"lessThan":"9813306610d0d718c863aaa70928bf57d7570ec0","status":"affected","version":"4fc82cd907ac075648789cc3a00877778aa1838b","versionType":"git"},{"lessThan":"9deaacc8dcaddb6ddc5b52e1e63b457450ec0f94","status":"affected","version":"4fc82cd907ac075648789cc3a00877778aa1838b","versionType":"git"},{"lessThan":"0da6697e577023d8867c7beb2d16a22510e4eea9","status":"affected","version":"4fc82cd907ac075648789cc3a00877778aa1838b","versionType":"git"},{"lessThan":"10e60d87813989e20eac1f3eda30b3bae461e7f9","status":"affected","version":"4fc82cd907ac075648789cc3a00877778aa1838b","versionType":"git"},{"status":"affected","version":"c04f2780919f20e2cc4846764221f5e802555868","versionType":"git"},{"status":"affected","version":"025bc6b41e020aeb1e71f84ae3ffce945026de05","versionType":"git"},{"lessThan":"5.10.252","status":"affected","version":"5.10.214","versionType":"semver"},{"lessThan":"5.15.202","status":"affected","version":"5.15.153","versionType":"semver"},{"lessThan":"6.1.165","status":"affected","version":"6.1.83","versionType":"semver"},{"lessThan":"6.6.128","status":"affected","version":"6.6.23","versionType":"semver"},{"lessThan":"6.8","status":"affected","version":"6.7.11","versionType":"semver"},{"lessThan":"6.9","status":"affected","version":"6.8.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iommu/intel/pasid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F301F41A-824C-4760-91D6-829EA98625CE","versionEndExcluding":"5.10.252","versionStartIncluding":"5.10.214","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"117A1A1F-F0DE-44E4-B126-9D004FA22B98","versionEndExcluding":"5.15.202","versionStartIncluding":"5.15.153","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED05E435-2E50-4978-9EB7-7CD836BB7F33","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.83","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"700B618A-E90E-4922-BA41-8FCAD15AC28F","versionEndExcluding":"6.6.128","versionStartIncluding":"6.6.23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CD8383BB-B294-4F4D-996D-A780685E6362","versionEndExcluding":"6.8","versionStartIncluding":"6.7.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2596BDC4-B8B0-4DD1-B529-FDCF124D0E31","versionEndExcluding":"6.12.75","versionStartIncluding":"6.8.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode\n\nCommit 4fc82cd907ac (\"iommu/vt-d: Don't issue ATS Invalidation\nrequest when device is disconnected\") relies on\npci_dev_is_disconnected() to skip ATS invalidation for\nsafely-removed devices, but it does not cover link-down caused\nby faults, which can still hard-lock the system.\n\nFor example, if a VM fails to connect to the PCIe device,\n\"virsh destroy\" is executed to release resources and isolate\nthe fault, but a hard-lockup occurs while releasing the group fd.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n intel_pasid_tear_down_entry\n device_block_translation\n blocking_domain_attach_dev\n __iommu_attach_device\n __iommu_device_set_domain\n __iommu_group_set_domain_internal\n iommu_detach_group\n vfio_iommu_type1_detach_group\n vfio_group_detach_container\n vfio_group_fops_release\n __fput\n\nAlthough pci_device_is_present() is slower than\npci_dev_is_disconnected(), it still takes only ~70 µs on a\nConnectX-5 (8 GT/s, x2) and becomes even faster as PCIe speed\nand width increase.\n\nBesides, devtlb_invalidation_with_pasid() is called only in the\npaths below, which are far less frequent than memory map/unmap.\n\n1. mm-struct release\n2. {attach,release}_dev\n3. set/remove PASID\n4. dirty-tracking setup\n\nThe gain in system stability far outweighs the negligible cost\nof using pci_device_is_present() instead of pci_dev_is_disconnected()\nto decide when to skip ATS invalidation, especially under GDR\nhigh-load conditions."}],"id":"CVE-2026-43130","lastModified":"2026-11-06T16:18:23.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43130","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:00.364045Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.083","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0da6697e577023d8867c7beb2d16a22510e4eea9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10e60d87813989e20eac1f3eda30b3bae461e7f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/581ce094d9eafb78ec4f9de77bd24b780c151236"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9813306610d0d718c863aaa70928bf57d7570ec0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9deaacc8dcaddb6ddc5b52e1e63b457450ec0f94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2c78c69f8faf2885ea4ceee08c71ac738f401a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ead67d0378e90f419e385a43af29435242d80c12"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iommu/intel/pasid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"581ce094d9eafb78ec4f9de77bd24b780c151236","status":"affected","version":"f873b85ec762c5a6abe94a7ddb31df5d3ba07d85","versionType":"git"},{"lessThan":"e2c78c69f8faf2885ea4ceee08c71ac738f401a0","status":"affected","version":"d70f1c85113cd8c2aa8373f491ca5d1b22ec0554","versionType":"git"},{"lessThan":"ead67d0378e90f419e385a43af29435242d80c12","status":"affected","version":"34a7b30f56d30114bf4d436e4dc793afe326fbcf","versionType":"git"},{"lessThan":"01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d","status":"affected","version":"2b74b2a92e524d7c8dec8e02e95ecf18b667c062","versionType":"git"},{"lessThan":"9813306610d0d718c863aaa70928bf57d7570ec0","status":"affected","version":"4fc82cd907ac075648789cc3a00877778aa1838b","versionType":"git"},{"lessThan":"9deaacc8dcaddb6ddc5b52e1e63b457450ec0f94","status":"affected","version":"4fc82cd907ac075648789cc3a00877778aa1838b","versionType":"git"},{"lessThan":"0da6697e577023d8867c7beb2d16a22510e4eea9","status":"affected","version":"4fc82cd907ac075648789cc3a00877778aa1838b","versionType":"git"},{"lessThan":"10e60d87813989e20eac1f3eda30b3bae461e7f9","status":"affected","version":"4fc82cd907ac075648789cc3a00877778aa1838b","versionType":"git"},{"status":"affected","version":"c04f2780919f20e2cc4846764221f5e802555868","versionType":"git"},{"status":"affected","version":"025bc6b41e020aeb1e71f84ae3ffce945026de05","versionType":"git"},{"lessThan":"5.10.252","status":"affected","version":"5.10.214","versionType":"semver"},{"lessThan":"5.15.202","status":"affected","version":"5.15.153","versionType":"semver"},{"lessThan":"6.1.165","status":"affected","version":"6.1.83","versionType":"semver"},{"lessThan":"6.6.128","status":"affected","version":"6.6.23","versionType":"semver"},{"lessThan":"6.8","status":"affected","version":"6.7.11","versionType":"semver"},{"lessThan":"6.9","status":"affected","version":"6.8.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iommu/intel/pasid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F301F41A-824C-4760-91D6-829EA98625CE","versionEndExcluding":"5.10.252","versionStartIncluding":"5.10.214","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"117A1A1F-F0DE-44E4-B126-9D004FA22B98","versionEndExcluding":"5.15.202","versionStartIncluding":"5.15.153","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED05E435-2E50-4978-9EB7-7CD836BB7F33","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.83","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"700B618A-E90E-4922-BA41-8FCAD15AC28F","versionEndExcluding":"6.6.128","versionStartIncluding":"6.6.23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CD8383BB-B294-4F4D-996D-A780685E6362","versionEndExcluding":"6.8","versionStartIncluding":"6.7.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2596BDC4-B8B0-4DD1-B529-FDCF124D0E31","versionEndExcluding":"6.12.75","versionStartIncluding":"6.8.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode\n\nCommit 4fc82cd907ac (\"iommu/vt-d: Don't issue ATS Invalidation\nrequest when device is disconnected\") relies on\npci_dev_is_disconnected() to skip ATS invalidation for\nsafely-removed devices, but it does not cover link-down caused\nby faults, which can still hard-lock the system.\n\nFor example, if a VM fails to connect to the PCIe device,\n\"virsh destroy\" is executed to release resources and isolate\nthe fault, but a hard-lockup occurs while releasing the group fd.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n intel_pasid_tear_down_entry\n device_block_translation\n blocking_domain_attach_dev\n __iommu_attach_device\n __iommu_device_set_domain\n __iommu_group_set_domain_internal\n iommu_detach_group\n vfio_iommu_type1_detach_group\n vfio_group_detach_container\n vfio_group_fops_release\n __fput\n\nAlthough pci_device_is_present() is slower than\npci_dev_is_disconnected(), it still takes only ~70 µs on a\nConnectX-5 (8 GT/s, x2) and becomes even faster as PCIe speed\nand width increase.\n\nBesides, devtlb_invalidation_with_pasid() is called only in the\npaths below, which are far less frequent than memory map/unmap.\n\n1. mm-struct release\n2. {attach,release}_dev\n3. set/remove PASID\n4. dirty-tracking setup\n\nThe gain in system stability far outweighs the negligible cost\nof using pci_device_is_present() instead of pci_dev_is_disconnected()\nto decide when to skip ATS invalidation, especially under GDR\nhigh-load conditions."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommu/vt-d: Vaciar dev-IOTLB solo cuando el dispositivo PCIe es accesible en modo escalable\n\nEl commit 4fc82cd907ac (’iommu/vt-d: No emitir solicitud de invalidación ATS cuando el dispositivo está desconectado’) se basa en pci_dev_is_disconnected() para omitir la invalidación ATS para dispositivos retirados de forma segura, pero no cubre la caída de enlace causada por fallos, lo que aún puede bloquear el sistema de forma irreversible.\n\nPor ejemplo, si una VM no logra conectarse al dispositivo PCIe, se ejecuta ’virsh destroy’ para liberar recursos y aislar el fallo, pero se produce un bloqueo irreversible mientras se libera el fd del grupo.\n\nTraza de llamadas:\n qi_submit_sync\n qi_flush_dev_iotlb\n intel_pasid_tear_down_entry\n device_block_translation\n blocking_domain_attach_dev\n __iommu_attach_device\n __iommu_device_set_domain\n __iommu_group_set_domain_internal\n iommu_detach_group\n vfio_iommu_type1_detach_group\n vfio_group_detach_container\n vfio_group_fops_release\n __fput\n\nAunque pci_device_is_present() es más lento que pci_dev_is_disconnected(), aún tarda solo ~70 µs en un ConnectX-5 (8 GT/s, x2) y se vuelve aún más rápido a medida que aumentan la velocidad y el ancho de PCIe.\n\nAdemás, devtlb_invalidation_with_pasid() se llama solo en las rutas siguientes, las cuales son mucho menos frecuentes que el mapeo/desmapeo de memoria.\n\n1. Liberación de mm-struct\n2. {attach,release}_dev\n3. Establecer/eliminar PASID\n4. Configuración de seguimiento de suciedad\n\nLa ganancia en estabilidad del sistema supera con creces el costo insignificante de usar pci_device_is_present() en lugar de pci_dev_is_disconnected() para decidir cuándo omitir la invalidación ATS, especialmente bajo condiciones de alta carga de GDR."}],"id":"CVE-2026-43130","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43130","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:00.364045Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.083","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0da6697e577023d8867c7beb2d16a22510e4eea9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10e60d87813989e20eac1f3eda30b3bae461e7f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/581ce094d9eafb78ec4f9de77bd24b780c151236"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9813306610d0d718c863aaa70928bf57d7570ec0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9deaacc8dcaddb6ddc5b52e1e63b457450ec0f94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2c78c69f8faf2885ea4ceee08c71ac738f401a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ead67d0378e90f419e385a43af29435242d80c12"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43131.json b/data/2026/CVE-2026-43131.json
index 4d91f15b5a..2f882f314e 100644
--- a/data/2026/CVE-2026-43131.json
+++ b/data/2026/CVE-2026-43131.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8e035505fa0e5b7c4306fd3f4e27f8e8f5bfad8c","status":"affected","version":"80e462c5b1963059dd78ee4650a3dfd53de4a10f","versionType":"git"},{"lessThan":"1197366cca89a4c44c541ddedb8ce8bf0757993d","status":"affected","version":"80e462c5b1963059dd78ee4650a3dfd53de4a10f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6459F69A-5AEB-42B1-8962-B4C4E364C033","versionEndExcluding":"6.19.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Fix null pointer dereference issue\n\nIf SMU is disabled, during RAS initialization,\nthere will be null pointer dereference issue here."}],"id":"CVE-2026-43131","lastModified":"2026-11-06T16:18:24.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43131","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:07.226511Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.243","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1197366cca89a4c44c541ddedb8ce8bf0757993d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8e035505fa0e5b7c4306fd3f4e27f8e8f5bfad8c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8e035505fa0e5b7c4306fd3f4e27f8e8f5bfad8c","status":"affected","version":"80e462c5b1963059dd78ee4650a3dfd53de4a10f","versionType":"git"},{"lessThan":"1197366cca89a4c44c541ddedb8ce8bf0757993d","status":"affected","version":"80e462c5b1963059dd78ee4650a3dfd53de4a10f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6459F69A-5AEB-42B1-8962-B4C4E364C033","versionEndExcluding":"6.19.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Fix null pointer dereference issue\n\nIf SMU is disabled, during RAS initialization,\nthere will be null pointer dereference issue here."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/pm: Corrección del problema de desreferencia de puntero nulo\n\nSi SMU está deshabilitado, durante la inicialización de RAS, habrá un problema de desreferencia de puntero nulo aquí."}],"id":"CVE-2026-43131","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43131","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:07.226511Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.243","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1197366cca89a4c44c541ddedb8ce8bf0757993d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8e035505fa0e5b7c4306fd3f4e27f8e8f5bfad8c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43132.json b/data/2026/CVE-2026-43132.json
index abed661c12..b4c7b7c492 100644
--- a/data/2026/CVE-2026-43132.json
+++ b/data/2026/CVE-2026-43132.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/dm-verity-fec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6283e49af87a9c121bb01e5a64a7fe5706c210bc","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"d3e1f1adc8a0289efe2d2cdc90edb8c6ffe0b5ef","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"5c2217ddb3b7e7ac25f4ebe9061258fc8f1c9167","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"031f2adc1499b112a39ac316bbab3c80bba16cf2","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"9b8dc1d327e2928f3da59ced0595d850d31c0936","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"451cc650e40e8c3222d37877a9e4be0fcaacb9c8","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"b154a868a3856fb5216c4f82981d8a503832e095","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"119f4f04186fa4f33ee6bd39af145cdaff1ff17f","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/dm-verity-fec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"11E23433-D08C-4704-9F30-C2866E3394DD","versionEndExcluding":"5.10.252","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: correctly handle dm_bufio_client_create() failure\n\nIf either of the calls to dm_bufio_client_create() in verity_fec_ctr()\nfails, then dm_bufio_client_destroy() is later called with an ERR_PTR()\nargument.  That causes a crash.  Fix this."}],"id":"CVE-2026-43132","lastModified":"2026-11-06T16:18:24.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:11.377343Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.357","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/031f2adc1499b112a39ac316bbab3c80bba16cf2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/119f4f04186fa4f33ee6bd39af145cdaff1ff17f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/451cc650e40e8c3222d37877a9e4be0fcaacb9c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c2217ddb3b7e7ac25f4ebe9061258fc8f1c9167"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6283e49af87a9c121bb01e5a64a7fe5706c210bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b8dc1d327e2928f3da59ced0595d850d31c0936"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b154a868a3856fb5216c4f82981d8a503832e095"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3e1f1adc8a0289efe2d2cdc90edb8c6ffe0b5ef"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/dm-verity-fec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6283e49af87a9c121bb01e5a64a7fe5706c210bc","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"d3e1f1adc8a0289efe2d2cdc90edb8c6ffe0b5ef","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"5c2217ddb3b7e7ac25f4ebe9061258fc8f1c9167","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"031f2adc1499b112a39ac316bbab3c80bba16cf2","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"9b8dc1d327e2928f3da59ced0595d850d31c0936","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"451cc650e40e8c3222d37877a9e4be0fcaacb9c8","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"b154a868a3856fb5216c4f82981d8a503832e095","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"},{"lessThan":"119f4f04186fa4f33ee6bd39af145cdaff1ff17f","status":"affected","version":"a739ff3f543afbb4a041c16cd0182c8e8d366e70","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/dm-verity-fec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"11E23433-D08C-4704-9F30-C2866E3394DD","versionEndExcluding":"5.10.252","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: correctly handle dm_bufio_client_create() failure\n\nIf either of the calls to dm_bufio_client_create() in verity_fec_ctr()\nfails, then dm_bufio_client_destroy() is later called with an ERR_PTR()\nargument.  That causes a crash.  Fix this."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndm-verity: manejar correctamente el fallo de dm_bufio_client_create()\n\nSi cualquiera de las llamadas a dm_bufio_client_create() en verity_fec_ctr() falla, entonces dm_bufio_client_destroy() es llamada posteriormente con un argumento ERR_PTR(). Eso causa un fallo. Corregir esto."}],"id":"CVE-2026-43132","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:11.377343Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.357","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/031f2adc1499b112a39ac316bbab3c80bba16cf2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/119f4f04186fa4f33ee6bd39af145cdaff1ff17f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/451cc650e40e8c3222d37877a9e4be0fcaacb9c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c2217ddb3b7e7ac25f4ebe9061258fc8f1c9167"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6283e49af87a9c121bb01e5a64a7fe5706c210bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b8dc1d327e2928f3da59ced0595d850d31c0936"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b154a868a3856fb5216c4f82981d8a503832e095"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3e1f1adc8a0289efe2d2cdc90edb8c6ffe0b5ef"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43133.json b/data/2026/CVE-2026-43133.json
index 8ccd0d3809..33837e261e 100644
--- a/data/2026/CVE-2026-43133.json
+++ b/data/2026/CVE-2026-43133.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/svm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"10063e1251c1485034a018236080792ad083dcc5","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"c3b7015000988ba35ecd5648f4b2283960f00543","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"3880e331b0b31d0d5d3702b124f6c93539cd478a","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"fce2fd4a2ca05670a91015aacccf96a1c26268fd","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"d464cf1ed900d47c85393d40b00017b6adfc2e6c","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"0004ecb798b30e90d7ebfe74efae2d9423315a64","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"127ccae2c185f62e6ecb4bf24f9cb307e9b9c619","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/svm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.53.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.46.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"libkrun","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unknown","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5A03991A-3AEB-4B4D-987D-1A1007DF71F0","versionEndExcluding":"5.15.202","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n\nCommit cc3ed80ae69f (\"KVM: nSVM: always use vmcb01 to for vmsave/vmload\nof guest state\") made KVM always use vmcb01 for the fields controlled by\nVMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code\nto always use vmcb01.\n\nAs a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not\nintercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01\ninstead of the current VMCB."}],"id":"CVE-2026-43133","lastModified":"2026-10-19T20:18:07.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.9,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":5.3,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.9,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":5.3,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43133","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:59.320752Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.480","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:65334"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66180"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66357"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67468"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67469"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43133"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467065"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43133.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-754"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-628"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/svm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"10063e1251c1485034a018236080792ad083dcc5","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"c3b7015000988ba35ecd5648f4b2283960f00543","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"3880e331b0b31d0d5d3702b124f6c93539cd478a","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"fce2fd4a2ca05670a91015aacccf96a1c26268fd","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"d464cf1ed900d47c85393d40b00017b6adfc2e6c","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"0004ecb798b30e90d7ebfe74efae2d9423315a64","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"},{"lessThan":"127ccae2c185f62e6ecb4bf24f9cb307e9b9c619","status":"affected","version":"cc3ed80ae69f454c3d904af9f65394a540099723","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/svm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.53.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.46.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"libkrun","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unknown","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5A03991A-3AEB-4B4D-987D-1A1007DF71F0","versionEndExcluding":"5.15.202","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n\nCommit cc3ed80ae69f (\"KVM: nSVM: always use vmcb01 to for vmsave/vmload\nof guest state\") made KVM always use vmcb01 for the fields controlled by\nVMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code\nto always use vmcb01.\n\nAs a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not\nintercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01\ninstead of the current VMCB."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: nSVM: Siempre usar vmcb01 en la emulación de VMLOAD/VMSAVE\n\nEl commit cc3ed80ae69f (’KVM: nSVM: siempre usar vmcb01 para vmsave/vmload del estado del invitado’) hizo que KVM siempre usara vmcb01 para los campos controlados por VMSAVE/VMLOAD, pero omitió actualizar el código de emulación de VMLOAD/VMSAVE para que siempre usara vmcb01.\n\nComo resultado, si VMSAVE/VMLOAD es ejecutado por un invitado L2 y no es interceptado por L1, KVM usará erróneamente vmcb02. Siempre usar vmcb01 en lugar del VMCB actual."}],"id":"CVE-2026-43133","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.9,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":5.3,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.9,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":5.3,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43133","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:14:59.320752Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.480","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:65334"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66180"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:66357"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67468"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67469"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43133"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467065"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43133.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-754"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-628"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43134.json b/data/2026/CVE-2026-43134.json
index 375fe7aeb2..1a641d7937 100644
--- a/data/2026/CVE-2026-43134.json
+++ b/data/2026/CVE-2026-43134.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"335071c0c3637064ec250481f589075db44fe4e6","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"fa6ad76fa8623c0a50d529cd5726fa5d819a3be4","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"9118601ff90b79e8df3c0c98f48ae00c1b02ecef","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"481ea39b342c347b6ac029f3d418486280be4e45","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"ec91078e132179b04e0c3906b599816c056ceaad","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"96581749c7c14fbec32c35728520867929600041","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"8dd43f9a9323f9c01bc8246da8d81a4c783c9e97","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"138d7eca445ef37a0333425d269ee59900ca1104","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"220A1B84-28FD-4537-8887-03669AE354D2","versionEndExcluding":"5.10.252","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ\n\nThis adds a check for encryption key size upon receiving\nL2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which\nexpects L2CAP_CR_LE_BAD_KEY_SIZE."}],"id":"CVE-2026-43134","lastModified":"2026-10-19T20:18:08.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:03.252855Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.617","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-326"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"335071c0c3637064ec250481f589075db44fe4e6","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"fa6ad76fa8623c0a50d529cd5726fa5d819a3be4","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"9118601ff90b79e8df3c0c98f48ae00c1b02ecef","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"481ea39b342c347b6ac029f3d418486280be4e45","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"ec91078e132179b04e0c3906b599816c056ceaad","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"96581749c7c14fbec32c35728520867929600041","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"8dd43f9a9323f9c01bc8246da8d81a4c783c9e97","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"},{"lessThan":"138d7eca445ef37a0333425d269ee59900ca1104","status":"affected","version":"27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"220A1B84-28FD-4537-8887-03669AE354D2","versionEndExcluding":"5.10.252","versionStartIncluding":"3.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ\n\nThis adds a check for encryption key size upon receiving\nL2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which\nexpects L2CAP_CR_LE_BAD_KEY_SIZE."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Corrección de la falta de comprobación del tamaño de clave para L2CAP_LE_CONN_REQ\n\nEsto añade una comprobación para el tamaño de clave de cifrado al recibir L2CAP_LE_CONN_REQ, lo cual es requerido por L2CAP/LE/CFC/BV-15-C que espera L2CAP_CR_LE_BAD_KEY_SIZE."}],"id":"CVE-2026-43134","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:03.252855Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.617","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-326"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43135.json b/data/2026/CVE-2026-43135.json
index 5e2feea27d..3796730868 100644
--- a/data/2026/CVE-2026-43135.json
+++ b/data/2026/CVE-2026-43135.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/pci/cx23885/cx23885-alsa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fda46c9025b755ea50a969b960f333be62421b71","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"0b7f56084cc3d7766bf274b71cd14cc9674b76bf","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"505630dd1ebf4b53d3f2866c057ddd93157a24d8","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"544215cc37d032ccaf1919852c05e2439a4d7540","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"9c0a6ff538660c36a98081916a24f08d55a91331","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"9544b73cad4ee667fed6a60f71570c58a870a735","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"fc4df593a8ffded2f77d69a73ecb51d364932ca5","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"141c81849fab2ad4d6e3fdaff7cbaa873e8b5eb2","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/pci/cx23885/cx23885-alsa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.18"},{"lessThan":"3.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"84E6C840-09B8-4381-8C73-31E14F879CCE","versionEndExcluding":"5.10.252","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx23885: Add missing unmap in snd_cx23885_hw_params()\n\nIn error path, add cx23885_alsa_dma_unmap() to release the\nresource acquired by cx23885_alsa_dma_map()."}],"id":"CVE-2026-43135","lastModified":"2026-11-06T16:18:24.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43135","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:15.574567Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.747","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b7f56084cc3d7766bf274b71cd14cc9674b76bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/141c81849fab2ad4d6e3fdaff7cbaa873e8b5eb2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/505630dd1ebf4b53d3f2866c057ddd93157a24d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/544215cc37d032ccaf1919852c05e2439a4d7540"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9544b73cad4ee667fed6a60f71570c58a870a735"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c0a6ff538660c36a98081916a24f08d55a91331"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fc4df593a8ffded2f77d69a73ecb51d364932ca5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fda46c9025b755ea50a969b960f333be62421b71"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/pci/cx23885/cx23885-alsa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fda46c9025b755ea50a969b960f333be62421b71","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"0b7f56084cc3d7766bf274b71cd14cc9674b76bf","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"505630dd1ebf4b53d3f2866c057ddd93157a24d8","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"544215cc37d032ccaf1919852c05e2439a4d7540","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"9c0a6ff538660c36a98081916a24f08d55a91331","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"9544b73cad4ee667fed6a60f71570c58a870a735","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"fc4df593a8ffded2f77d69a73ecb51d364932ca5","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"},{"lessThan":"141c81849fab2ad4d6e3fdaff7cbaa873e8b5eb2","status":"affected","version":"9529a4b0cf49163e489446ec159a2dfb64f78df8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/pci/cx23885/cx23885-alsa.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.18"},{"lessThan":"3.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"84E6C840-09B8-4381-8C73-31E14F879CCE","versionEndExcluding":"5.10.252","versionStartIncluding":"3.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx23885: Add missing unmap in snd_cx23885_hw_params()\n\nIn error path, add cx23885_alsa_dma_unmap() to release the\nresource acquired by cx23885_alsa_dma_map()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: cx23885: Añadir desmapeo faltante en snd_cx23885_hw_params()\n\nEn la ruta de error, añadir cx23885_alsa_dma_unmap() para liberar el recurso adquirido por cx23885_alsa_dma_map()."}],"id":"CVE-2026-43135","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43135","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:15.574567Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.747","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b7f56084cc3d7766bf274b71cd14cc9674b76bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/141c81849fab2ad4d6e3fdaff7cbaa873e8b5eb2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/505630dd1ebf4b53d3f2866c057ddd93157a24d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/544215cc37d032ccaf1919852c05e2439a4d7540"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9544b73cad4ee667fed6a60f71570c58a870a735"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c0a6ff538660c36a98081916a24f08d55a91331"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fc4df593a8ffded2f77d69a73ecb51d364932ca5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fda46c9025b755ea50a969b960f333be62421b71"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43136.json b/data/2026/CVE-2026-43136.json
index d463ab3817..be9fb67ef8 100644
--- a/data/2026/CVE-2026-43136.json
+++ b/data/2026/CVE-2026-43136.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-logitech-hidpp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ae81fac9ce81917817d787e6b74e68482d99bdf2","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"2dc023dbc11b8dfa8afa63242762acd8cddcad03","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"7f59999fcd699af06ad2aef446a635ea6aa87db3","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"b74bf7d0d01fa9b53653f58c29aa00772121f6e9","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"f1ceaaf93ea32d0f2b95c95f784ee155962c52ad","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"1acb28123e57b50d737377f400f57eec889fe5e4","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"fb1725c0804dbec9dd01c4cb5c9f1f77a69e36dc","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"1547d41f9f19d691c2c9ce4c29f746297baef9e9","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-logitech-hidpp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"60080FD7-0394-4349-8DD9-10D099A3D189","versionEndExcluding":"5.10.252","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Check maxfield in hidpp_get_report_length()\n\nDo not crash when a report has no fields.\n\nFake USB gadgets can send their own HID report descriptors and can define report\nstructures without valid fields.  This can be used to crash the kernel over USB."}],"id":"CVE-2026-43136","lastModified":"2026-11-06T16:18:24.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43136","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:20.507703Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.880","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1547d41f9f19d691c2c9ce4c29f746297baef9e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1acb28123e57b50d737377f400f57eec889fe5e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2dc023dbc11b8dfa8afa63242762acd8cddcad03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7f59999fcd699af06ad2aef446a635ea6aa87db3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae81fac9ce81917817d787e6b74e68482d99bdf2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b74bf7d0d01fa9b53653f58c29aa00772121f6e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1ceaaf93ea32d0f2b95c95f784ee155962c52ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb1725c0804dbec9dd01c4cb5c9f1f77a69e36dc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-logitech-hidpp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ae81fac9ce81917817d787e6b74e68482d99bdf2","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"2dc023dbc11b8dfa8afa63242762acd8cddcad03","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"7f59999fcd699af06ad2aef446a635ea6aa87db3","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"b74bf7d0d01fa9b53653f58c29aa00772121f6e9","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"f1ceaaf93ea32d0f2b95c95f784ee155962c52ad","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"1acb28123e57b50d737377f400f57eec889fe5e4","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"fb1725c0804dbec9dd01c4cb5c9f1f77a69e36dc","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"},{"lessThan":"1547d41f9f19d691c2c9ce4c29f746297baef9e9","status":"affected","version":"fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-logitech-hidpp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"60080FD7-0394-4349-8DD9-10D099A3D189","versionEndExcluding":"5.10.252","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Check maxfield in hidpp_get_report_length()\n\nDo not crash when a report has no fields.\n\nFake USB gadgets can send their own HID report descriptors and can define report\nstructures without valid fields.  This can be used to crash the kernel over USB."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: logitech-hidpp: Comprobar maxfield en hidpp_get_report_length()\n\nNo bloquearse cuando un informe no tiene campos.\n\nDispositivos USB falsos pueden enviar sus propios descriptores de informe HID y pueden definir estructuras de informe sin campos válidos. Esto puede ser usado para bloquear el kernel a través de USB."}],"id":"CVE-2026-43136","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43136","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:20.507703Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:30.880","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1547d41f9f19d691c2c9ce4c29f746297baef9e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1acb28123e57b50d737377f400f57eec889fe5e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2dc023dbc11b8dfa8afa63242762acd8cddcad03"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7f59999fcd699af06ad2aef446a635ea6aa87db3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae81fac9ce81917817d787e6b74e68482d99bdf2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b74bf7d0d01fa9b53653f58c29aa00772121f6e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1ceaaf93ea32d0f2b95c95f784ee155962c52ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb1725c0804dbec9dd01c4cb5c9f1f77a69e36dc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43137.json b/data/2026/CVE-2026-43137.json
index 697bdf9d50..023a8f4b4c 100644
--- a/data/2026/CVE-2026-43137.json
+++ b/data/2026/CVE-2026-43137.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/soc/sof/intel/hda-dai.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a1d4f3d3c0dc86527da6a19f6901a6a48375500d","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"},{"lessThan":"10411f1f2c76be67103b1f95822ff629aa25e2aa","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"},{"lessThan":"42068f7dd42b559c4eeae645e1455ff36518866a","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"},{"lessThan":"7750d78b4014902bc0ac03d4bb30faa076a913ab","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"},{"lessThan":"16c589567a956d46a7c1363af3f64de3d420af20","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/soc/sof/intel/hda-dai.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.141","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CAA073DB-607E-4D74-9B88-0379E8C760F6","versionEndExcluding":"6.12.75","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda: Fix NULL pointer dereference\n\nIf there's a mismatch between the DAI links in the machine driver and\nthe topology, it is possible that the playback/capture widget is not\nset, especially in the case of loopback capture for echo reference\nwhere we use the dummy DAI link. Return the error when the widget is not\nset to avoid a null pointer dereference like below when the topology is\nbroken.\n\nRIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]"}],"id":"CVE-2026-43137","lastModified":"2026-11-06T16:18:24.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43137","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:25.350526Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:31.007","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10411f1f2c76be67103b1f95822ff629aa25e2aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42068f7dd42b559c4eeae645e1455ff36518866a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7750d78b4014902bc0ac03d4bb30faa076a913ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a1d4f3d3c0dc86527da6a19f6901a6a48375500d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/soc/sof/intel/hda-dai.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a1d4f3d3c0dc86527da6a19f6901a6a48375500d","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"},{"lessThan":"10411f1f2c76be67103b1f95822ff629aa25e2aa","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"},{"lessThan":"42068f7dd42b559c4eeae645e1455ff36518866a","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"},{"lessThan":"7750d78b4014902bc0ac03d4bb30faa076a913ab","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"},{"lessThan":"16c589567a956d46a7c1363af3f64de3d420af20","status":"affected","version":"0acb48dd31e39b617bb12ca546b4fecd6ccb2972","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/soc/sof/intel/hda-dai.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.141","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CAA073DB-607E-4D74-9B88-0379E8C760F6","versionEndExcluding":"6.12.75","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda: Fix NULL pointer dereference\n\nIf there's a mismatch between the DAI links in the machine driver and\nthe topology, it is possible that the playback/capture widget is not\nset, especially in the case of loopback capture for echo reference\nwhere we use the dummy DAI link. Return the error when the widget is not\nset to avoid a null pointer dereference like below when the topology is\nbroken.\n\nRIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nASoC: SOF: Intel: hda: Corrección de desreferencia de puntero NULL\n\nSi existe una discrepancia entre los enlaces DAI en el controlador de la máquina y la topología, es posible que el widget de reproducción/captura no esté configurado, especialmente en el caso de la captura en bucle para referencia de eco donde usamos el enlace DAI ficticio. Devolver el error cuando el widget no está configurado para evitar una desreferencia de puntero NULL como la siguiente cuando la topología está rota.\n\nRIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]"}],"id":"CVE-2026-43137","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43137","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:25.350526Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:31.007","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10411f1f2c76be67103b1f95822ff629aa25e2aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42068f7dd42b559c4eeae645e1455ff36518866a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7750d78b4014902bc0ac03d4bb30faa076a913ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a1d4f3d3c0dc86527da6a19f6901a6a48375500d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43138.json b/data/2026/CVE-2026-43138.json
index 29471c8e0e..0a976493e2 100644
--- a/data/2026/CVE-2026-43138.json
+++ b/data/2026/CVE-2026-43138.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/reset/reset-gpio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"09d6efc6abd42809956d598906c222ccd1c8ae92","status":"affected","version":"cee544a40e4426040946e685988b1489f13e6600","versionType":"git"},{"lessThan":"76801c3dfca0ac6339a23e9615b5f23e25b8644c","status":"affected","version":"cee544a40e4426040946e685988b1489f13e6600","versionType":"git"},{"lessThan":"1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b","status":"affected","version":"cee544a40e4426040946e685988b1489f13e6600","versionType":"git"},{"lessThan":"16de4c6a8fe9ff497ca1aba33ef0dbee09f11952","status":"affected","version":"cee544a40e4426040946e685988b1489f13e6600","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/reset/reset-gpio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F8A1C6F6-2847-4C53-ABFC-8F07D96900D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nreset: gpio: suppress bind attributes in sysfs\n\nThis is a special device that's created dynamically and is supposed to\nstay in memory forever. We also currently don't have a devlink between\nit and the actual reset consumer. Suppress sysfs bind attributes so that\nuser-space can't unbind the device because - as of now - it will cause a\nuse-after-free splat from any user that puts the reset control handle."}],"id":"CVE-2026-43138","lastModified":"2026-06-17T10:49:00.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.117","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09d6efc6abd42809956d598906c222ccd1c8ae92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76801c3dfca0ac6339a23e9615b5f23e25b8644c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/reset/reset-gpio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"09d6efc6abd42809956d598906c222ccd1c8ae92","status":"affected","version":"cee544a40e4426040946e685988b1489f13e6600","versionType":"git"},{"lessThan":"76801c3dfca0ac6339a23e9615b5f23e25b8644c","status":"affected","version":"cee544a40e4426040946e685988b1489f13e6600","versionType":"git"},{"lessThan":"1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b","status":"affected","version":"cee544a40e4426040946e685988b1489f13e6600","versionType":"git"},{"lessThan":"16de4c6a8fe9ff497ca1aba33ef0dbee09f11952","status":"affected","version":"cee544a40e4426040946e685988b1489f13e6600","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/reset/reset-gpio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F8A1C6F6-2847-4C53-ABFC-8F07D96900D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nreset: gpio: suppress bind attributes in sysfs\n\nThis is a special device that's created dynamically and is supposed to\nstay in memory forever. We also currently don't have a devlink between\nit and the actual reset consumer. Suppress sysfs bind attributes so that\nuser-space can't unbind the device because - as of now - it will cause a\nuse-after-free splat from any user that puts the reset control handle."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nreset: gpio: suprimir atributos de enlace en sysfs\n\nEste es un dispositivo especial que se crea dinámicamente y se supone que debe permanecer en memoria para siempre. Tampoco tenemos actualmente un devlink entre él y el consumidor de reinicio real. Suprimir los atributos de enlace de sysfs para que el espacio de usuario no pueda desvincular el dispositivo porque - a partir de ahora - causará un splat de uso después de liberación de cualquier usuario que ponga el manejador de control de reinicio."}],"id":"CVE-2026-43138","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.117","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09d6efc6abd42809956d598906c222ccd1c8ae92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76801c3dfca0ac6339a23e9615b5f23e25b8644c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43139.json b/data/2026/CVE-2026-43139.json
index bbadb9c49b..e5dd1ef999 100644
--- a/data/2026/CVE-2026-43139.json
+++ b/data/2026/CVE-2026-43139.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/xfrm6_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4f28141786e1fe884ce42a5197ba9beed540f0ea","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"6535867673bf301d52aa00593a4d1d18cc3922fa","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"eb2ee15290af14c60b45cf2b73f5687d1d077d9b","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"719918fc88df6da023dfff370cd965151a5afd7f","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"dc0abce055134cb83b0d981d31ceb20dda419787","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"c7221e7bd8fc2ef38a0b27be580d9d202281306b","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"3dcd1664ac15eee6a690daec7c4ffc59190406f7","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"1799d8abeabc68ec05679292aaf6cba93b343c05","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/xfrm6_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"128F081F-CEB9-49AD-8832-F177C6299DED","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: fix uninitialized saddr in xfrm6_get_saddr()\n\nxfrm6_get_saddr() does not check the return value of\nipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable\nsource address (returns -EADDRNOTAVAIL), saddr->in6 is left\nuninitialized, but xfrm6_get_saddr() still returns 0 (success).\n\nThis causes the caller xfrm_tmpl_resolve_one() to use the uninitialized\naddress in xfrm_state_find(), triggering KMSAN warning:\n\n=====================================================\nBUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940\n xfrm_state_find+0x2424/0xa940\n xfrm_resolve_and_create_bundle+0x906/0x5a20\n xfrm_lookup_with_ifid+0xcc0/0x3770\n xfrm_lookup_route+0x63/0x2b0\n ip_route_output_flow+0x1ce/0x270\n udp_sendmsg+0x2ce1/0x3400\n inet_sendmsg+0x1ef/0x2a0\n __sock_sendmsg+0x278/0x3d0\n __sys_sendto+0x593/0x720\n __x64_sys_sendto+0x130/0x200\n x64_sys_call+0x332b/0x3e70\n do_syscall_64+0xd3/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable tmp.i.i created at:\n xfrm_resolve_and_create_bundle+0x3e3/0x5a20\n xfrm_lookup_with_ifid+0xcc0/0x3770\n=====================================================\n\nFix by checking the return value of ipv6_dev_get_saddr() and propagating\nthe error."}],"id":"CVE-2026-43139","lastModified":"2026-10-19T20:18:08.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43139","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:07.789549Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:31.227","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1799d8abeabc68ec05679292aaf6cba93b343c05"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3dcd1664ac15eee6a690daec7c4ffc59190406f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f28141786e1fe884ce42a5197ba9beed540f0ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6535867673bf301d52aa00593a4d1d18cc3922fa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/719918fc88df6da023dfff370cd965151a5afd7f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c7221e7bd8fc2ef38a0b27be580d9d202281306b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dc0abce055134cb83b0d981d31ceb20dda419787"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb2ee15290af14c60b45cf2b73f5687d1d077d9b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-457"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/xfrm6_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4f28141786e1fe884ce42a5197ba9beed540f0ea","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"6535867673bf301d52aa00593a4d1d18cc3922fa","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"eb2ee15290af14c60b45cf2b73f5687d1d077d9b","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"719918fc88df6da023dfff370cd965151a5afd7f","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"dc0abce055134cb83b0d981d31ceb20dda419787","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"c7221e7bd8fc2ef38a0b27be580d9d202281306b","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"3dcd1664ac15eee6a690daec7c4ffc59190406f7","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"},{"lessThan":"1799d8abeabc68ec05679292aaf6cba93b343c05","status":"affected","version":"a1e59abf824969554b90facd44a4ab16e265afa4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/xfrm6_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"128F081F-CEB9-49AD-8832-F177C6299DED","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: fix uninitialized saddr in xfrm6_get_saddr()\n\nxfrm6_get_saddr() does not check the return value of\nipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable\nsource address (returns -EADDRNOTAVAIL), saddr->in6 is left\nuninitialized, but xfrm6_get_saddr() still returns 0 (success).\n\nThis causes the caller xfrm_tmpl_resolve_one() to use the uninitialized\naddress in xfrm_state_find(), triggering KMSAN warning:\n\n=====================================================\nBUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940\n xfrm_state_find+0x2424/0xa940\n xfrm_resolve_and_create_bundle+0x906/0x5a20\n xfrm_lookup_with_ifid+0xcc0/0x3770\n xfrm_lookup_route+0x63/0x2b0\n ip_route_output_flow+0x1ce/0x270\n udp_sendmsg+0x2ce1/0x3400\n inet_sendmsg+0x1ef/0x2a0\n __sock_sendmsg+0x278/0x3d0\n __sys_sendto+0x593/0x720\n __x64_sys_sendto+0x130/0x200\n x64_sys_call+0x332b/0x3e70\n do_syscall_64+0xd3/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable tmp.i.i created at:\n xfrm_resolve_and_create_bundle+0x3e3/0x5a20\n xfrm_lookup_with_ifid+0xcc0/0x3770\n=====================================================\n\nFix by checking the return value of ipv6_dev_get_saddr() and propagating\nthe error."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm6: corrección de saddr no inicializada en xfrm6_get_saddr()\n\nxfrm6_get_saddr() no comprueba el valor de retorno de ipv6_dev_get_saddr(). Cuando ipv6_dev_get_saddr() no logra encontrar una dirección de origen adecuada (devuelve -EADDRNOTAVAIL), saddr  ->  in6 queda sin inicializar, pero xfrm6_get_saddr() aún devuelve 0 (éxito).\n\nEsto hace que la función llamadora xfrm_tmpl_resolve_one() use la dirección no inicializada en xfrm_state_find(), lo que activa la advertencia de KMSAN:\n\n=====================================================\nBUG: KMSAN: uninit-value in xfrm_state_find+0x 2424/0x a940\n xfrm_state_find+0x 2424/0x a940\n xfrm_resolve_and_create_bundle+0x906/0x 5a20\n xfrm_lookup_with_ifid+0xcc0/0x 3770\n xfrm_lookup_route+0x63/0x2b0\n ip_route_output_flow+0x1ce/0x270\n udp_sendmsg+0x 2ce1/0x 3400\n inet_sendmsg+0x1ef/0x2a0\n __sock_sendmsg+0x278/0x3d0\n __sys_sendto+0x593/0x720\n __x64_sys_sendto+0x130/0x200\n x64_sys_call+0x 332b/0x 3e70\n do_syscall_64+0xd3/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable tmp.i.i created at:\n xfrm_resolve_and_create_bundle+0x3e3/0x 5a20\n xfrm_lookup_with_ifid+0xcc0/0x 3770\n=====================================================\n\nSolución comprobando el valor de retorno de ipv6_dev_get_saddr() y propagando el error."}],"id":"CVE-2026-43139","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43139","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:07.789549Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:31.227","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1799d8abeabc68ec05679292aaf6cba93b343c05"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3dcd1664ac15eee6a690daec7c4ffc59190406f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f28141786e1fe884ce42a5197ba9beed540f0ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6535867673bf301d52aa00593a4d1d18cc3922fa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/719918fc88df6da023dfff370cd965151a5afd7f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c7221e7bd8fc2ef38a0b27be580d9d202281306b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dc0abce055134cb83b0d981d31ceb20dda419787"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb2ee15290af14c60b45cf2b73f5687d1d077d9b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-457"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43140.json b/data/2026/CVE-2026-43140.json
index 354f2387dc..0d2d6206b7 100644
--- a/data/2026/CVE-2026-43140.json
+++ b/data/2026/CVE-2026-43140.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-magicmouse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"165912d4321c692321c02793068d30700b4e0f1a","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"f6a3860241fbb556fd72332fa31c5e787004413b","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"243e1165eb03aca97d87aafa9c3130593837a1c2","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"922bd3e498a4b8e445def6e6ffea2ad3682ad516","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"5bbe266272d86c0657e8253600f3d5b74fb7b2ae","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"36c83c1329dd881f290f7df2feadfb9a21775108","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"17abd396548035fbd6179ee1a431bd75d49676a7","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-magicmouse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.37"},{"lessThan":"2.6.37","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3501E160-8CFB-4029-9B41-70DC384AF6E0","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.37","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: Do not crash on missing msc->input\n\nFake USB devices can send their own report descriptors for which the\ninput_mapping() hook does not get called.  In this case, msc->input stays NULL,\nleading to a crash at a later time.\n\nDetect this condition in the input_configured() hook and reject the device.\n\nThis is not supposed to happen with actual magic mouse devices, but can be\nprovoked by imposing as a magic mouse USB device."}],"id":"CVE-2026-43140","lastModified":"2026-11-06T16:18:24.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43140","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:29.443571Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:31.370","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/165912d4321c692321c02793068d30700b4e0f1a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/17abd396548035fbd6179ee1a431bd75d49676a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/243e1165eb03aca97d87aafa9c3130593837a1c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36c83c1329dd881f290f7df2feadfb9a21775108"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5bbe266272d86c0657e8253600f3d5b74fb7b2ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/922bd3e498a4b8e445def6e6ffea2ad3682ad516"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6a3860241fbb556fd72332fa31c5e787004413b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-magicmouse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"165912d4321c692321c02793068d30700b4e0f1a","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"f6a3860241fbb556fd72332fa31c5e787004413b","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"243e1165eb03aca97d87aafa9c3130593837a1c2","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"922bd3e498a4b8e445def6e6ffea2ad3682ad516","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"5bbe266272d86c0657e8253600f3d5b74fb7b2ae","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"36c83c1329dd881f290f7df2feadfb9a21775108","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"},{"lessThan":"17abd396548035fbd6179ee1a431bd75d49676a7","status":"affected","version":"64eb105d7f92fa48798106ac0d8bf17668eb2524","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-magicmouse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.37"},{"lessThan":"2.6.37","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3501E160-8CFB-4029-9B41-70DC384AF6E0","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.37","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: Do not crash on missing msc->input\n\nFake USB devices can send their own report descriptors for which the\ninput_mapping() hook does not get called.  In this case, msc->input stays NULL,\nleading to a crash at a later time.\n\nDetect this condition in the input_configured() hook and reject the device.\n\nThis is not supposed to happen with actual magic mouse devices, but can be\nprovoked by imposing as a magic mouse USB device."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: magicmouse: No se bloquee por la falta de msc  ->  input\n\nLos dispositivos USB falsos pueden enviar sus propios descriptores de informe para los cuales no se llama al hook input_mapping(). En este caso, msc  ->  input permanece NULL, lo que lleva a un bloqueo en un momento posterior.\n\nDetectar esta condición en el hook input_configured() y rechazar el dispositivo.\n\nEsto no debería ocurrir con dispositivos Magic Mouse reales, pero puede ser provocado al hacerse pasar por un dispositivo USB Magic Mouse."}],"id":"CVE-2026-43140","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43140","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:29.443571Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:31.370","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/165912d4321c692321c02793068d30700b4e0f1a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/17abd396548035fbd6179ee1a431bd75d49676a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/243e1165eb03aca97d87aafa9c3130593837a1c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36c83c1329dd881f290f7df2feadfb9a21775108"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5bbe266272d86c0657e8253600f3d5b74fb7b2ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/922bd3e498a4b8e445def6e6ffea2ad3682ad516"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6a3860241fbb556fd72332fa31c5e787004413b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43141.json b/data/2026/CVE-2026-43141.json
index c560a29f68..4e70f5957f 100644
--- a/data/2026/CVE-2026-43141.json
+++ b/data/2026/CVE-2026-43141.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/ntb/hw/mscc/ntb_hw_switchtec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d652ef399f131fcd5f8f34266167449ee7c9e5b3","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"5590cd04d6845c01a6bad985a491c58af6fb5389","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"a11d03d116eef138a7249202bd772c8e61915aec","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"d0559d07afabfddaaded6a61a16154486b956764","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"2e4d5e8d86a969318340be95470bb76e52392082","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"a133e3caf844a3f56b6eef89ddaa66115874f6bd","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"1a867d0d79a4a570a33f2f433919ad2bd7a27b67","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"186615f8855a0be4ee7d3fcd09a8ecc10e783b08","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/ntb/hw/mscc/ntb_hw_switchtec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0DACC27E-2C7E-4A63-8C6D-D02E7C1191F3","versionEndExcluding":"5.10.252","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut\n\nNumber of MW LUTs depends on NTB configuration and can be set to zero,\nin such scenario rounddown_pow_of_two will cause undefined behaviour and\nshould not be performed.\nThis patch ensures that rounddown_pow_of_two is called on valid value."}],"id":"CVE-2026-43141","lastModified":"2026-06-17T10:49:00.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.493","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/186615f8855a0be4ee7d3fcd09a8ecc10e783b08"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a867d0d79a4a570a33f2f433919ad2bd7a27b67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e4d5e8d86a969318340be95470bb76e52392082"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5590cd04d6845c01a6bad985a491c58af6fb5389"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a11d03d116eef138a7249202bd772c8e61915aec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a133e3caf844a3f56b6eef89ddaa66115874f6bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0559d07afabfddaaded6a61a16154486b956764"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d652ef399f131fcd5f8f34266167449ee7c9e5b3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/ntb/hw/mscc/ntb_hw_switchtec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d652ef399f131fcd5f8f34266167449ee7c9e5b3","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"5590cd04d6845c01a6bad985a491c58af6fb5389","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"a11d03d116eef138a7249202bd772c8e61915aec","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"d0559d07afabfddaaded6a61a16154486b956764","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"2e4d5e8d86a969318340be95470bb76e52392082","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"a133e3caf844a3f56b6eef89ddaa66115874f6bd","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"1a867d0d79a4a570a33f2f433919ad2bd7a27b67","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"},{"lessThan":"186615f8855a0be4ee7d3fcd09a8ecc10e783b08","status":"affected","version":"ec0467ccbdeb69a86c8729073057bda7bce00eec","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/ntb/hw/mscc/ntb_hw_switchtec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0DACC27E-2C7E-4A63-8C6D-D02E7C1191F3","versionEndExcluding":"5.10.252","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut\n\nNumber of MW LUTs depends on NTB configuration and can be set to zero,\nin such scenario rounddown_pow_of_two will cause undefined behaviour and\nshould not be performed.\nThis patch ensures that rounddown_pow_of_two is called on valid value."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nntb: ntb_hw_switchtec: Corrección de desplazamiento fuera de límites para 0 mw lut\n\nEl número de MW LUTs depende de la configuración de NTB y puede establecerse en cero; en tal escenario, rounddown_pow_of_two causará un comportamiento indefinido y no debería realizarse.\nEste parche asegura que rounddown_pow_of_two se llama con un valor válido."}],"id":"CVE-2026-43141","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.493","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/186615f8855a0be4ee7d3fcd09a8ecc10e783b08"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a867d0d79a4a570a33f2f433919ad2bd7a27b67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e4d5e8d86a969318340be95470bb76e52392082"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5590cd04d6845c01a6bad985a491c58af6fb5389"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a11d03d116eef138a7249202bd772c8e61915aec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a133e3caf844a3f56b6eef89ddaa66115874f6bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0559d07afabfddaaded6a61a16154486b956764"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d652ef399f131fcd5f8f34266167449ee7c9e5b3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43142.json b/data/2026/CVE-2026-43142.json
index 29cddb4810..4ad49bc6c5 100644
--- a/data/2026/CVE-2026-43142.json
+++ b/data/2026/CVE-2026-43142.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7cde76db8883ec8a3d1456068079ecadbfb15ca5","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"},{"lessThan":"d4457f23ac0130240053a34be663f0fade3bb371","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"},{"lessThan":"1dabf00ee206eceb0f08a1fe5d1ce635f9064338","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC","versionEndExcluding":"6.18.16","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: iris: gen1: Destroy internal buffers after FW releases\n\nAfter the firmware releases internal buffers, the driver was not\ndestroying them. This left stale allocations that were no longer used,\nespecially across resolution changes where new buffers are allocated per\nthe updated requirements. As a result, memory was wasted until session\nclose.\n\nDestroy internal buffers once the release response is received from the\nfirmware."}],"id":"CVE-2026-43142","lastModified":"2026-06-17T10:49:00.863","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1dabf00ee206eceb0f08a1fe5d1ce635f9064338"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7cde76db8883ec8a3d1456068079ecadbfb15ca5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d4457f23ac0130240053a34be663f0fade3bb371"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7cde76db8883ec8a3d1456068079ecadbfb15ca5","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"},{"lessThan":"d4457f23ac0130240053a34be663f0fade3bb371","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"},{"lessThan":"1dabf00ee206eceb0f08a1fe5d1ce635f9064338","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC","versionEndExcluding":"6.18.16","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: iris: gen1: Destroy internal buffers after FW releases\n\nAfter the firmware releases internal buffers, the driver was not\ndestroying them. This left stale allocations that were no longer used,\nespecially across resolution changes where new buffers are allocated per\nthe updated requirements. As a result, memory was wasted until session\nclose.\n\nDestroy internal buffers once the release response is received from the\nfirmware."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: iris: gen1: Destruir búferes internos después de que el firmware los libere\n\nDespués de que el firmware liberaba los búferes internos, el controlador no los destruía. Esto dejaba asignaciones obsoletas que ya no se utilizaban, especialmente en los cambios de resolución donde se asignan nuevos búferes según los requisitos actualizados. Como resultado, se desperdiciaba memoria hasta el cierre de la sesión.\n\nDestruir los búferes internos una vez que se reciba la respuesta de liberación del firmware."}],"id":"CVE-2026-43142","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1dabf00ee206eceb0f08a1fe5d1ce635f9064338"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7cde76db8883ec8a3d1456068079ecadbfb15ca5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d4457f23ac0130240053a34be663f0fade3bb371"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43143.json b/data/2026/CVE-2026-43143.json
index 43d28a5bda..70d35cb268 100644
--- a/data/2026/CVE-2026-43143.json
+++ b/data/2026/CVE-2026-43143.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mfd/mfd-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dcfa679bba02412f2087be21cf06ae88b1f4e0ef","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"e2e7c275f557e2b75e3128f4818063798248774c","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"db131ef9d8980cf60dcac8cf94c036eccf75e5d0","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"9b02e3fec3a7fcb990b4d3bd3b13d7edf123dca6","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"45341856ecda1d56689451abd5cf1d1aa57dbe47","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"20117c92bcf9c11afd64d7481d8f94fdf410726e","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mfd/mfd-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C071FD3B-46E1-4938-B277-F84C773B9F56","versionEndExcluding":"6.1.165","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: core: Add locking around 'mfd_of_node_list'\n\nManipulating a list in the kernel isn't safe without some sort of\nmutual exclusion. Add a mutex any time we access / modify\n'mfd_of_node_list' to prevent possible crashes."}],"id":"CVE-2026-43143","lastModified":"2026-11-06T16:18:25.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43143","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:33.347402Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:31.747","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20117c92bcf9c11afd64d7481d8f94fdf410726e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45341856ecda1d56689451abd5cf1d1aa57dbe47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b02e3fec3a7fcb990b4d3bd3b13d7edf123dca6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db131ef9d8980cf60dcac8cf94c036eccf75e5d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dcfa679bba02412f2087be21cf06ae88b1f4e0ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2e7c275f557e2b75e3128f4818063798248774c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mfd/mfd-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dcfa679bba02412f2087be21cf06ae88b1f4e0ef","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"e2e7c275f557e2b75e3128f4818063798248774c","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"db131ef9d8980cf60dcac8cf94c036eccf75e5d0","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"9b02e3fec3a7fcb990b4d3bd3b13d7edf123dca6","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"45341856ecda1d56689451abd5cf1d1aa57dbe47","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"},{"lessThan":"20117c92bcf9c11afd64d7481d8f94fdf410726e","status":"affected","version":"466a62d7642f02f36d37d9b30c19a725538a01ca","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mfd/mfd-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C071FD3B-46E1-4938-B277-F84C773B9F56","versionEndExcluding":"6.1.165","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: core: Add locking around 'mfd_of_node_list'\n\nManipulating a list in the kernel isn't safe without some sort of\nmutual exclusion. Add a mutex any time we access / modify\n'mfd_of_node_list' to prevent possible crashes."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmfd: core: Añadir bloqueo alrededor de ’mfd_of_node_list’\n\nManipular una lista en el kernel no es seguro sin algún tipo de exclusión mutua. Añadir un mutex cada vez que accedemos / modificamos ’mfd_of_node_list’ para prevenir posibles fallos."}],"id":"CVE-2026-43143","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43143","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:33.347402Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:31.747","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20117c92bcf9c11afd64d7481d8f94fdf410726e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45341856ecda1d56689451abd5cf1d1aa57dbe47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b02e3fec3a7fcb990b4d3bd3b13d7edf123dca6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db131ef9d8980cf60dcac8cf94c036eccf75e5d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dcfa679bba02412f2087be21cf06ae88b1f4e0ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2e7c275f557e2b75e3128f4818063798248774c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43144.json b/data/2026/CVE-2026-43144.json
index 3819ff0d8f..4d7f252b02 100644
--- a/data/2026/CVE-2026-43144.json
+++ b/data/2026/CVE-2026-43144.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c","drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c","drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"64ccb0aac41c5055780c2a58bbe2c1b362ceccde","status":"affected","version":"0ff0843310b74e565901d85f849fb308c3b1f220","versionType":"git"},{"lessThan":"379aac7ee8240848aa35f605b06addb4617c863e","status":"affected","version":"0ff0843310b74e565901d85f849fb308c3b1f220","versionType":"git"},{"lessThan":"243307a0d1b0d01538e202c00454c28b21d4432e","status":"affected","version":"0ff0843310b74e565901d85f849fb308c3b1f220","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c","drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c","drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential kernel oops when probe fails\n\nWhen probe of the sdio brcmfmac device fails for some reasons (i.e.\nmissing firmware), the sdiodev->bus is set to error instead of NULL, thus\nthe cleanup later in brcmf_sdio_remove() tries to free resources via\ninvalid bus pointer. This happens because sdiodev->bus is set 2 times:\nfirst in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix\nthis by chaning the brcmf_sdio_probe() function to return the error code\nand set sdio->bus only there."}],"id":"CVE-2026-43144","lastModified":"2026-06-17T10:49:01.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.870","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/243307a0d1b0d01538e202c00454c28b21d4432e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/379aac7ee8240848aa35f605b06addb4617c863e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64ccb0aac41c5055780c2a58bbe2c1b362ceccde"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c","drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c","drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"64ccb0aac41c5055780c2a58bbe2c1b362ceccde","status":"affected","version":"0ff0843310b74e565901d85f849fb308c3b1f220","versionType":"git"},{"lessThan":"379aac7ee8240848aa35f605b06addb4617c863e","status":"affected","version":"0ff0843310b74e565901d85f849fb308c3b1f220","versionType":"git"},{"lessThan":"243307a0d1b0d01538e202c00454c28b21d4432e","status":"affected","version":"0ff0843310b74e565901d85f849fb308c3b1f220","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c","drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c","drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix potential kernel oops when probe fails\n\nWhen probe of the sdio brcmfmac device fails for some reasons (i.e.\nmissing firmware), the sdiodev->bus is set to error instead of NULL, thus\nthe cleanup later in brcmf_sdio_remove() tries to free resources via\ninvalid bus pointer. This happens because sdiodev->bus is set 2 times:\nfirst in brcmf_sdio_probe() and second time in brcmf_sdiod_probe(). Fix\nthis by chaning the brcmf_sdio_probe() function to return the error code\nand set sdio->bus only there."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: brcmfmac: Arregla un posible kernel oops cuando el sondeo falla\n\nCuando el sondeo del dispositivo sdio brcmfmac falla por algunas razones (es decir, firmware faltante), el sdiodev  ->  bus se establece en error en lugar de NULL, por lo tanto, la limpieza posterior en brcmf_sdio_remove() intenta liberar recursos a través de un puntero de bus inválido. Esto sucede porque sdiodev  ->  bus se establece 2 veces: primero en brcmf_sdio_probe() y la segunda vez en brcmf_sdiod_probe(). Arregla esto cambiando la función brcmf_sdio_probe() para que devuelva el código de error y establezca sdio  ->  bus solo allí."}],"id":"CVE-2026-43144","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.870","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/243307a0d1b0d01538e202c00454c28b21d4432e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/379aac7ee8240848aa35f605b06addb4617c863e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64ccb0aac41c5055780c2a58bbe2c1b362ceccde"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43145.json b/data/2026/CVE-2026-43145.json
index c06549e82d..fedada49ae 100644
--- a/data/2026/CVE-2026-43145.json
+++ b/data/2026/CVE-2026-43145.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/remoteproc/imx_rproc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"91baf24d972ea3c04a75dd18821c03d223c0dbc0","status":"affected","version":"64f2ca5ce97111a364a18c31772eb46c79e8b772","versionType":"git"},{"lessThan":"fcec79b6a3649ae7b1f659267602ca402c240d6e","status":"affected","version":"1d750606fedcdff7886f35a558c51b05ce2680a6","versionType":"git"},{"lessThan":"9bd98d088f47153a81a6ec8162b4415c64aa7f39","status":"affected","version":"7fb5f957213bc7268bac449f8bfe95967c9f3f3b","versionType":"git"},{"lessThan":"65379adf7d231c930572db45933ff4538f4c5128","status":"affected","version":"e954a1bd16102abc800629f9900715d8ec4c3130","versionType":"git"},{"lessThan":"500778df9e4c313190368908ff40c23948508e97","status":"affected","version":"e954a1bd16102abc800629f9900715d8ec4c3130","versionType":"git"},{"lessThan":"198c629bd03863591f3fbf5ce8ff974a33f13dc9","status":"affected","version":"e954a1bd16102abc800629f9900715d8ec4c3130","versionType":"git"},{"lessThan":"26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d","status":"affected","version":"e954a1bd16102abc800629f9900715d8ec4c3130","versionType":"git"},{"status":"affected","version":"3d131f138e092c414c69860f2c897c59d660da99","versionType":"git"},{"lessThan":"5.15.202","status":"affected","version":"5.15.168","versionType":"semver"},{"lessThan":"6.1.165","status":"affected","version":"6.1.113","versionType":"semver"},{"lessThan":"6.6.128","status":"affected","version":"6.6.57","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/remoteproc/imx_rproc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F99C1353-35FC-4EA3-9F3F-12FBA3999A3C","versionEndExcluding":"5.15.202","versionStartIncluding":"5.15.168","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D459FB56-9DA7-40FC-88CB-1EF9D809A028","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.113","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"614164BB-328D-4E06-889A-B69E26B4299D","versionEndExcluding":"6.6.128","versionStartIncluding":"6.6.57","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B0095F61-6451-4EEA-8A3C-B162067EE13A","versionEndExcluding":"6.12.75","versionStartIncluding":"6.11.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: imx_rproc: Fix invalid loaded resource table detection\n\nimx_rproc_elf_find_loaded_rsc_table() may incorrectly report a loaded\nresource table even when the current firmware does not provide one.\n\nWhen the device tree contains a \"rsc-table\" entry, priv->rsc_table is\nnon-NULL and denotes where a resource table would be located if one is\npresent in memory. However, when the current firmware has no resource\ntable, rproc->table_ptr is NULL. The function still returns\npriv->rsc_table, and the remoteproc core interprets this as a valid loaded\nresource table.\n\nFix this by returning NULL from imx_rproc_elf_find_loaded_rsc_table() when\nthere is no resource table for the current firmware (i.e. when\nrproc->table_ptr is NULL). This aligns the function's semantics with the\nremoteproc core: a loaded resource table is only reported when a valid\ntable_ptr exists.\n\nWith this change, starting firmware without a resource table no longer\ntriggers a crash."}],"id":"CVE-2026-43145","lastModified":"2026-06-17T10:49:01.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.983","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/198c629bd03863591f3fbf5ce8ff974a33f13dc9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/500778df9e4c313190368908ff40c23948508e97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65379adf7d231c930572db45933ff4538f4c5128"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91baf24d972ea3c04a75dd18821c03d223c0dbc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bd98d088f47153a81a6ec8162b4415c64aa7f39"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fcec79b6a3649ae7b1f659267602ca402c240d6e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/remoteproc/imx_rproc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"91baf24d972ea3c04a75dd18821c03d223c0dbc0","status":"affected","version":"64f2ca5ce97111a364a18c31772eb46c79e8b772","versionType":"git"},{"lessThan":"fcec79b6a3649ae7b1f659267602ca402c240d6e","status":"affected","version":"1d750606fedcdff7886f35a558c51b05ce2680a6","versionType":"git"},{"lessThan":"9bd98d088f47153a81a6ec8162b4415c64aa7f39","status":"affected","version":"7fb5f957213bc7268bac449f8bfe95967c9f3f3b","versionType":"git"},{"lessThan":"65379adf7d231c930572db45933ff4538f4c5128","status":"affected","version":"e954a1bd16102abc800629f9900715d8ec4c3130","versionType":"git"},{"lessThan":"500778df9e4c313190368908ff40c23948508e97","status":"affected","version":"e954a1bd16102abc800629f9900715d8ec4c3130","versionType":"git"},{"lessThan":"198c629bd03863591f3fbf5ce8ff974a33f13dc9","status":"affected","version":"e954a1bd16102abc800629f9900715d8ec4c3130","versionType":"git"},{"lessThan":"26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d","status":"affected","version":"e954a1bd16102abc800629f9900715d8ec4c3130","versionType":"git"},{"status":"affected","version":"3d131f138e092c414c69860f2c897c59d660da99","versionType":"git"},{"lessThan":"5.15.202","status":"affected","version":"5.15.168","versionType":"semver"},{"lessThan":"6.1.165","status":"affected","version":"6.1.113","versionType":"semver"},{"lessThan":"6.6.128","status":"affected","version":"6.6.57","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/remoteproc/imx_rproc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F99C1353-35FC-4EA3-9F3F-12FBA3999A3C","versionEndExcluding":"5.15.202","versionStartIncluding":"5.15.168","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D459FB56-9DA7-40FC-88CB-1EF9D809A028","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.113","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"614164BB-328D-4E06-889A-B69E26B4299D","versionEndExcluding":"6.6.128","versionStartIncluding":"6.6.57","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B0095F61-6451-4EEA-8A3C-B162067EE13A","versionEndExcluding":"6.12.75","versionStartIncluding":"6.11.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: imx_rproc: Fix invalid loaded resource table detection\n\nimx_rproc_elf_find_loaded_rsc_table() may incorrectly report a loaded\nresource table even when the current firmware does not provide one.\n\nWhen the device tree contains a \"rsc-table\" entry, priv->rsc_table is\nnon-NULL and denotes where a resource table would be located if one is\npresent in memory. However, when the current firmware has no resource\ntable, rproc->table_ptr is NULL. The function still returns\npriv->rsc_table, and the remoteproc core interprets this as a valid loaded\nresource table.\n\nFix this by returning NULL from imx_rproc_elf_find_loaded_rsc_table() when\nthere is no resource table for the current firmware (i.e. when\nrproc->table_ptr is NULL). This aligns the function's semantics with the\nremoteproc core: a loaded resource table is only reported when a valid\ntable_ptr exists.\n\nWith this change, starting firmware without a resource table no longer\ntriggers a crash."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nremoteproc: imx_rproc: Corrección de la detección de tabla de recursos cargada inválida\n\nimx_rproc_elf_find_loaded_rsc_table() puede informar incorrectamente una tabla de recursos cargada incluso cuando el firmware actual no proporciona una.\n\nCuando el árbol de dispositivos contiene una entrada ’rsc-table’, priv  ->  rsc_table no es NULL e indica dónde se ubicaría una tabla de recursos si una está presente en la memoria. Sin embargo, cuando el firmware actual no tiene tabla de recursos, rproc  ->  table_ptr es NULL. La función aún devuelve priv  ->  rsc_table, y el núcleo remoteproc interpreta esto como una tabla de recursos cargada válida.\n\nSolucione esto devolviendo NULL desde imx_rproc_elf_find_loaded_rsc_table() cuando no hay tabla de recursos para el firmware actual (es decir, cuando rproc  ->  table_ptr es NULL). Esto alinea la semántica de la función con el núcleo remoteproc: una tabla de recursos cargada solo se informa cuando existe un table_ptr válido.\n\nCon este cambio, iniciar firmware sin una tabla de recursos ya no provoca un fallo."}],"id":"CVE-2026-43145","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:31.983","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/198c629bd03863591f3fbf5ce8ff974a33f13dc9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/500778df9e4c313190368908ff40c23948508e97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65379adf7d231c930572db45933ff4538f4c5128"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91baf24d972ea3c04a75dd18821c03d223c0dbc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bd98d088f47153a81a6ec8162b4415c64aa7f39"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fcec79b6a3649ae7b1f659267602ca402c240d6e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43146.json b/data/2026/CVE-2026-43146.json
index f3607a74cb..ee2cf7caae 100644
--- a/data/2026/CVE-2026-43146.json
+++ b/data/2026/CVE-2026-43146.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"45b30f65feeb4d5570d5337793bb0f298be813d2","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"},{"lessThan":"98b4c4c90f1e11caecbe2093dbe3a901d338bc81","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"},{"lessThan":"2d0bbd982dfdd67da488a772f7a8a1bdca7642bf","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC","versionEndExcluding":"6.18.16","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: iris: Add buffer to list only after successful allocation\n\nMove `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating\ninternal buffers. Previously, the buffer was enqueued in `buffers->list`\nbefore the DMA allocation. If the allocation failed, the function returned\n`-ENOMEM` while leaving a partially initialized buffer in the list, which\ncould lead to inconsistent state and potential leaks.\n\nBy adding the buffer to the list only after `dma_alloc_attrs()` succeeds,\nwe ensure the list contains only valid, fully initialized buffers."}],"id":"CVE-2026-43146","lastModified":"2026-06-17T10:49:01.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:32.127","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d0bbd982dfdd67da488a772f7a8a1bdca7642bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45b30f65feeb4d5570d5337793bb0f298be813d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98b4c4c90f1e11caecbe2093dbe3a901d338bc81"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"45b30f65feeb4d5570d5337793bb0f298be813d2","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"},{"lessThan":"98b4c4c90f1e11caecbe2093dbe3a901d338bc81","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"},{"lessThan":"2d0bbd982dfdd67da488a772f7a8a1bdca7642bf","status":"affected","version":"73702f45db81b74897b2808aaa13484826156006","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_buffer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5B5F989F-E891-48E4-9EC9-3C5EFD3DB9DC","versionEndExcluding":"6.18.16","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: iris: Add buffer to list only after successful allocation\n\nMove `list_add_tail()` to after `dma_alloc_attrs()` succeeds when creating\ninternal buffers. Previously, the buffer was enqueued in `buffers->list`\nbefore the DMA allocation. If the allocation failed, the function returned\n`-ENOMEM` while leaving a partially initialized buffer in the list, which\ncould lead to inconsistent state and potential leaks.\n\nBy adding the buffer to the list only after `dma_alloc_attrs()` succeeds,\nwe ensure the list contains only valid, fully initialized buffers."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: iris: Añadir búfer a la lista solo después de una asignación exitosa\n\nMover ’list_add_tail()’ a después de que ’dma_alloc_attrs()’ tenga éxito al crear búferes internos. Anteriormente, el búfer se encolaba en ’buffers  ->  list’ antes de la asignación DMA. Si la asignación fallaba, la función devolvía ’-ENOMEM’ mientras dejaba un búfer parcialmente inicializado en la lista, lo que podría llevar a un estado inconsistente y posibles fugas.\n\nAl añadir el búfer a la lista solo después de que ’dma_alloc_attrs()’ tenga éxito, nos aseguramos de que la lista contenga solo búferes válidos y completamente inicializados."}],"id":"CVE-2026-43146","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:32.127","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d0bbd982dfdd67da488a772f7a8a1bdca7642bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45b30f65feeb4d5570d5337793bb0f298be813d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98b4c4c90f1e11caecbe2093dbe3a901d338bc81"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43147.json b/data/2026/CVE-2026-43147.json
index 0f277bbff6..7e481287ef 100644
--- a/data/2026/CVE-2026-43147.json
+++ b/data/2026/CVE-2026-43147.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f61cdd7e9b67bb8961b0a81bf294b78343e5db05","status":"affected","version":"1e8a80290f964bdbad225221c8a1594c7e01c8fd","versionType":"git"},{"lessThan":"0de341b2365bad430aade0853fe09c2cbe468f59","status":"affected","version":"a645ca21de09e3137cbb224fa6c23cca873a1d01","versionType":"git"},{"lessThan":"83651d37474c762920e345a3a0828f975ca4d732","status":"affected","version":"a24219172456f035d886857e265ca24c85b167c8","versionType":"git"},{"lessThan":"639265296fe6ee21b6f00e00ee2bab65f3b07252","status":"affected","version":"36039348bca77828bf06eae41b8f76e38cd15847","versionType":"git"},{"lessThan":"d47f27e145f8bd13f3c230da5e3af29225b4a2f7","status":"affected","version":"53154cd40ccf285f1d1c24367824082061d155bd","versionType":"git"},{"lessThan":"40f67686a5002c0c322fac918406bbc8d9c2ec2f","status":"affected","version":"05703271c3cdcc0f2a8cf6ebdc45892b8ca83520","versionType":"git"},{"lessThan":"58677783c89681871077f50a7042b0c6380c4fd8","status":"affected","version":"05703271c3cdcc0f2a8cf6ebdc45892b8ca83520","versionType":"git"},{"lessThan":"2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a","status":"affected","version":"05703271c3cdcc0f2a8cf6ebdc45892b8ca83520","versionType":"git"},{"status":"affected","version":"5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf","versionType":"git"},{"status":"affected","version":"ee40e5db052d7c6f406fdb95ad639c894c74674c","versionType":"git"},{"lessThan":"5.10.252","status":"affected","version":"5.10.246","versionType":"semver"},{"lessThan":"5.15.202","status":"affected","version":"5.15.195","versionType":"semver"},{"lessThan":"6.1.165","status":"affected","version":"6.1.157","versionType":"semver"},{"lessThan":"6.6.128","status":"affected","version":"6.6.113","versionType":"semver"},{"lessThan":"6.12.75","status":"affected","version":"6.12.54","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.301","versionType":"semver"},{"lessThan":"6.18","status":"affected","version":"6.17.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABCD8233-CFD6-4194-AA34-BD9E287307E3","versionEndExcluding":"5.5","versionStartIncluding":"5.4.301","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4A9DDA2A-4C5B-4449-8771-770D86CF7DDE","versionEndExcluding":"5.10.252","versionStartIncluding":"5.10.246","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B24EB1FA-19B2-49D7-A69B-15888BE06274","versionEndExcluding":"5.15.202","versionStartIncluding":"5.15.195","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A1C6F3EA-9480-4F54-AA05-D52B53EC80F6","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.157","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C5E8E922-3FF0-431A-8702-035D4539BF13","versionEndExcluding":"6.6.128","versionStartIncluding":"6.6.113","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FC78A661-1343-4AFE-A84D-E36586DC36A9","versionEndExcluding":"6.12.75","versionStartIncluding":"6.12.54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"91D00E25-4134-4FD2-A41C-44EA3CF9D3EE","versionEndExcluding":"6.18.16","versionStartIncluding":"6.17.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"\n\nThis reverts commit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\"), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n  $ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs\n  $ echo 1 > /sys/bus/pci/devices/<pf>/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n  zsh/5715 is trying to acquire lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n  but task is already holding lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n  ...\n  Call Trace:\n   [<00000259778c4f90>] dump_stack_lvl+0xc0/0x110\n   [<00000259779c844e>] print_deadlock_bug+0x31e/0x330\n   [<00000259779c1908>] __lock_acquire+0x16c8/0x32f0\n   [<00000259779bffac>] lock_acquire+0x14c/0x350\n   [<00000259789643a6>] __mutex_lock_common+0xe6/0x1520\n   [<000002597896413c>] mutex_lock_nested+0x3c/0x50\n   [<00000259784a07e4>] sriov_disable+0x34/0x140\n   [<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n   [<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core]\n   [<00000259784857fc>] pci_device_remove+0x3c/0xa0\n   [<000002597851012e>] device_release_driver_internal+0x18e/0x280\n   [<000002597847ae22>] pci_stop_bus_device+0x82/0xa0\n   [<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n   [<00000259784972c2>] remove_store+0x72/0x90\n   [<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200\n   [<0000025977d7241c>] vfs_write+0x24c/0x300\n   [<0000025977d72696>] ksys_write+0x86/0x110\n   [<000002597895b61c>] __do_syscall+0x14c/0x400\n   [<000002597896e0ee>] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on."}],"id":"CVE-2026-43147","lastModified":"2026-11-06T16:18:25.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43147","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:37.623465Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:32.240","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0de341b2365bad430aade0853fe09c2cbe468f59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40f67686a5002c0c322fac918406bbc8d9c2ec2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58677783c89681871077f50a7042b0c6380c4fd8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/639265296fe6ee21b6f00e00ee2bab65f3b07252"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83651d37474c762920e345a3a0828f975ca4d732"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d47f27e145f8bd13f3c230da5e3af29225b4a2f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f61cdd7e9b67bb8961b0a81bf294b78343e5db05"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f61cdd7e9b67bb8961b0a81bf294b78343e5db05","status":"affected","version":"1e8a80290f964bdbad225221c8a1594c7e01c8fd","versionType":"git"},{"lessThan":"0de341b2365bad430aade0853fe09c2cbe468f59","status":"affected","version":"a645ca21de09e3137cbb224fa6c23cca873a1d01","versionType":"git"},{"lessThan":"83651d37474c762920e345a3a0828f975ca4d732","status":"affected","version":"a24219172456f035d886857e265ca24c85b167c8","versionType":"git"},{"lessThan":"639265296fe6ee21b6f00e00ee2bab65f3b07252","status":"affected","version":"36039348bca77828bf06eae41b8f76e38cd15847","versionType":"git"},{"lessThan":"d47f27e145f8bd13f3c230da5e3af29225b4a2f7","status":"affected","version":"53154cd40ccf285f1d1c24367824082061d155bd","versionType":"git"},{"lessThan":"40f67686a5002c0c322fac918406bbc8d9c2ec2f","status":"affected","version":"05703271c3cdcc0f2a8cf6ebdc45892b8ca83520","versionType":"git"},{"lessThan":"58677783c89681871077f50a7042b0c6380c4fd8","status":"affected","version":"05703271c3cdcc0f2a8cf6ebdc45892b8ca83520","versionType":"git"},{"lessThan":"2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a","status":"affected","version":"05703271c3cdcc0f2a8cf6ebdc45892b8ca83520","versionType":"git"},{"status":"affected","version":"5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf","versionType":"git"},{"status":"affected","version":"ee40e5db052d7c6f406fdb95ad639c894c74674c","versionType":"git"},{"lessThan":"5.10.252","status":"affected","version":"5.10.246","versionType":"semver"},{"lessThan":"5.15.202","status":"affected","version":"5.15.195","versionType":"semver"},{"lessThan":"6.1.165","status":"affected","version":"6.1.157","versionType":"semver"},{"lessThan":"6.6.128","status":"affected","version":"6.6.113","versionType":"semver"},{"lessThan":"6.12.75","status":"affected","version":"6.12.54","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.301","versionType":"semver"},{"lessThan":"6.18","status":"affected","version":"6.17.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/iov.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABCD8233-CFD6-4194-AA34-BD9E287307E3","versionEndExcluding":"5.5","versionStartIncluding":"5.4.301","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4A9DDA2A-4C5B-4449-8771-770D86CF7DDE","versionEndExcluding":"5.10.252","versionStartIncluding":"5.10.246","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B24EB1FA-19B2-49D7-A69B-15888BE06274","versionEndExcluding":"5.15.202","versionStartIncluding":"5.15.195","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A1C6F3EA-9480-4F54-AA05-D52B53EC80F6","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.157","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C5E8E922-3FF0-431A-8702-035D4539BF13","versionEndExcluding":"6.6.128","versionStartIncluding":"6.6.113","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FC78A661-1343-4AFE-A84D-E36586DC36A9","versionEndExcluding":"6.12.75","versionStartIncluding":"6.12.54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"91D00E25-4134-4FD2-A41C-44EA3CF9D3EE","versionEndExcluding":"6.18.16","versionStartIncluding":"6.17.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"\n\nThis reverts commit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\"), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n  $ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs\n  $ echo 1 > /sys/bus/pci/devices/<pf>/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n  zsh/5715 is trying to acquire lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n  but task is already holding lock:\n  000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n  ...\n  Call Trace:\n   [<00000259778c4f90>] dump_stack_lvl+0xc0/0x110\n   [<00000259779c844e>] print_deadlock_bug+0x31e/0x330\n   [<00000259779c1908>] __lock_acquire+0x16c8/0x32f0\n   [<00000259779bffac>] lock_acquire+0x14c/0x350\n   [<00000259789643a6>] __mutex_lock_common+0xe6/0x1520\n   [<000002597896413c>] mutex_lock_nested+0x3c/0x50\n   [<00000259784a07e4>] sriov_disable+0x34/0x140\n   [<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n   [<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core]\n   [<00000259784857fc>] pci_device_remove+0x3c/0xa0\n   [<000002597851012e>] device_release_driver_internal+0x18e/0x280\n   [<000002597847ae22>] pci_stop_bus_device+0x82/0xa0\n   [<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n   [<00000259784972c2>] remove_store+0x72/0x90\n   [<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200\n   [<0000025977d7241c>] vfs_write+0x24c/0x300\n   [<0000025977d72696>] ksys_write+0x86/0x110\n   [<000002597895b61c>] __do_syscall+0x14c/0x400\n   [<000002597896e0ee>] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: Revertir ’PCI/IOV: Añadir bloqueo de reescaneo-eliminación de PCI al habilitar/deshabilitar SR-IOV’ Esto revierte el commit 05703271c3cd (’PCI/IOV: Añadir bloqueo de reescaneo-eliminación de PCI al habilitar/deshabilitar SR-IOV’), lo que causa un interbloqueo al tomar recursivamente pci_rescan_remove_lock cuando se llama a sriov_del_vfs() como parte de pci_stop_and_remove_bus_device(). Por ejemplo, con la siguiente secuencia de comandos: $ echo [NUM] > /sys/bus/pci/devices/[pf]/sriov_numvfs $ echo 1 > /sys/bus/pci/devices/[pf]/remove Una traza recortada del interbloqueo en un dispositivo mlx5 es la siguiente: zsh/5715 está intentando adquirir el bloqueo: 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140 pero la tarea ya está manteniendo el bloqueo: 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80 ... Traza de Llamada: [menor que 00000259778c4f90>] dump_stack_lvl+0xc0/0x110 [menor que 00000259779c844e>] print_deadlock_bug+0x31e/0x330 [menor que 00000259779c1908>] __lock_acquire+0x 16c8/0x 32f0 [menor que 00000259779bffac>] lock_acquire+0x14c/0x350 [menor que 00000259789643a6>] __mutex_lock_common+0xe6/0x 1520 [menor que 000002597896413c>] mutex_lock_nested+0x3c/0x50 [menor que 00000259784a07e4>] sriov_disable+0x34/0x140 [menor que 00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core] [menor que 00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core] [menor que 00000259784857fc>] pci_device_remove+0x3c/0xa0 [menor que 000002597851012e>] device_release_driver_internal+0x18e/0x280 [menor que 000002597847ae22>] pci_stop_bus_device+0x82/0xa0 [menor que 000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80 [menor que 00000259784972c2>] remove_store+0x72/0x90 [menor que 0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200 [menor que 0000025977d7241c>] vfs_write+0x24c/0x300 [menor que 0000025977d72696>] ksys_write+0x86/0x110 [menor que 000002597895b61c>] __do_syscall+0x14c/0x400 [menor que 000002597896e0ee>] system_call+0x6e/0x90 Esto por sí solo no es una solución completa ya que restaura el problema que el commit citado intentó resolver. Una nueva solución será proporcionada como seguimiento."}],"id":"CVE-2026-43147","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43147","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:37.623465Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:32.240","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0de341b2365bad430aade0853fe09c2cbe468f59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40f67686a5002c0c322fac918406bbc8d9c2ec2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58677783c89681871077f50a7042b0c6380c4fd8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/639265296fe6ee21b6f00e00ee2bab65f3b07252"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83651d37474c762920e345a3a0828f975ca4d732"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d47f27e145f8bd13f3c230da5e3af29225b4a2f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f61cdd7e9b67bb8961b0a81bf294b78343e5db05"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43148.json b/data/2026/CVE-2026-43148.json
index 6df1cf53f3..5fc323366f 100644
--- a/data/2026/CVE-2026-43148.json
+++ b/data/2026/CVE-2026-43148.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/powerpc/kernel/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1de31dba19c3cd0c1caf388a286b46df638f0b91","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"b265e53d9adfbb5751713185843f7188aa9dd066","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"9d0ca11258e7b452653d04310addfec1753de1a2","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"ca46d2092f307385a7acfb42632056570d6dbbbc","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"9b85c8f624b0f8cf9b932f5a65dacd56a1f47a72","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"8b221db0b7d24675e465e98d9326d298025a4e8d","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"33c1c6d8a28a2761ac74b0380b2563cf546c2a3a","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/powerpc/kernel/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.11"},{"lessThan":"5.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/smp: Add check for kcalloc() failure in parse_thread_groups()\n\nAs kcalloc() may fail, check its return value to avoid a NULL pointer\ndereference when passing it to of_property_read_u32_array()."}],"id":"CVE-2026-43148","lastModified":"2026-11-06T16:18:25.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:41.722516Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:32.417","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1de31dba19c3cd0c1caf388a286b46df638f0b91"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33c1c6d8a28a2761ac74b0380b2563cf546c2a3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8b221db0b7d24675e465e98d9326d298025a4e8d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b85c8f624b0f8cf9b932f5a65dacd56a1f47a72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d0ca11258e7b452653d04310addfec1753de1a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b265e53d9adfbb5751713185843f7188aa9dd066"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca46d2092f307385a7acfb42632056570d6dbbbc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/powerpc/kernel/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1de31dba19c3cd0c1caf388a286b46df638f0b91","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"b265e53d9adfbb5751713185843f7188aa9dd066","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"9d0ca11258e7b452653d04310addfec1753de1a2","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"ca46d2092f307385a7acfb42632056570d6dbbbc","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"9b85c8f624b0f8cf9b932f5a65dacd56a1f47a72","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"8b221db0b7d24675e465e98d9326d298025a4e8d","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"},{"lessThan":"33c1c6d8a28a2761ac74b0380b2563cf546c2a3a","status":"affected","version":"790a1662d3a26fe9fa5f691386d8fde6bb8b0dc2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/powerpc/kernel/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.11"},{"lessThan":"5.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/smp: Add check for kcalloc() failure in parse_thread_groups()\n\nAs kcalloc() may fail, check its return value to avoid a NULL pointer\ndereference when passing it to of_property_read_u32_array()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npowerpc/smp: Añadir comprobación de fallo de kcalloc() en parse_thread_groups()\n\nComo kcalloc() puede fallar, comprobar su valor de retorno para evitar una desreferencia de puntero NULL al pasarlo a of_property_read_u32_array()."}],"id":"CVE-2026-43148","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:41.722516Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:32.417","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1de31dba19c3cd0c1caf388a286b46df638f0b91"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33c1c6d8a28a2761ac74b0380b2563cf546c2a3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8b221db0b7d24675e465e98d9326d298025a4e8d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b85c8f624b0f8cf9b932f5a65dacd56a1f47a72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d0ca11258e7b452653d04310addfec1753de1a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b265e53d9adfbb5751713185843f7188aa9dd066"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca46d2092f307385a7acfb42632056570d6dbbbc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43149.json b/data/2026/CVE-2026-43149.json
index 9b6f653956..1f3e2fdbe4 100644
--- a/data/2026/CVE-2026-43149.json
+++ b/data/2026/CVE-2026-43149.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wan/fsl_ucc_hdlc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6496fb830cbb741d831225cc4e7e5601c6e42970","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"011ae5dd84dc9f05eb9b8e1adff44252ac776e7b","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"0f85a9655445e67bb0238cfc983d7c383b54938e","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"84b932bc9899d43e5829e6cf088b72d73a922b2b","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"d8a522085d09b30aba1016daf1dddac37c0f0285","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"d68994e37ac3b285692559776e0279a88a3b5f8d","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"36bd7d5deef936c4e1e3cd341598140e5c14c1d3","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wan/fsl_ucc_hdlc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.8"},{"lessThan":"4.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"697D9392-58FC-4BC4-98E1-C18E1B2388F4","versionEndExcluding":"5.10.252","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()\n\nThe priv->rx_buffer and priv->tx_buffer are alloc'd together as\ncontiguous buffers in uhdlc_init() but freed as two buffers in\nuhdlc_memclean().\n\nChange the cleanup to only call dma_free_coherent() once on the whole\nbuffer."}],"id":"CVE-2026-43149","lastModified":"2026-06-17T10:49:01.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:32.553","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/011ae5dd84dc9f05eb9b8e1adff44252ac776e7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f85a9655445e67bb0238cfc983d7c383b54938e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36bd7d5deef936c4e1e3cd341598140e5c14c1d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6496fb830cbb741d831225cc4e7e5601c6e42970"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84b932bc9899d43e5829e6cf088b72d73a922b2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d68994e37ac3b285692559776e0279a88a3b5f8d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8a522085d09b30aba1016daf1dddac37c0f0285"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wan/fsl_ucc_hdlc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6496fb830cbb741d831225cc4e7e5601c6e42970","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"011ae5dd84dc9f05eb9b8e1adff44252ac776e7b","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"0f85a9655445e67bb0238cfc983d7c383b54938e","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"84b932bc9899d43e5829e6cf088b72d73a922b2b","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"d8a522085d09b30aba1016daf1dddac37c0f0285","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"d68994e37ac3b285692559776e0279a88a3b5f8d","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"},{"lessThan":"36bd7d5deef936c4e1e3cd341598140e5c14c1d3","status":"affected","version":"c19b6d246a35627c3a69b2fa6bdece212b48214b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wan/fsl_ucc_hdlc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.8"},{"lessThan":"4.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"697D9392-58FC-4BC4-98E1-C18E1B2388F4","versionEndExcluding":"5.10.252","versionStartIncluding":"4.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()\n\nThe priv->rx_buffer and priv->tx_buffer are alloc'd together as\ncontiguous buffers in uhdlc_init() but freed as two buffers in\nuhdlc_memclean().\n\nChange the cleanup to only call dma_free_coherent() once on the whole\nbuffer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: wan/fsl_ucc_hdlc: Corrección de dma_free_coherent() en uhdlc_memclean()\n\nLos priv  ->  rx_buffer y priv  ->  tx_buffer se asignan juntos como búferes contiguos en uhdlc_init() pero se liberan como dos búferes en uhdlc_memclean().\n\nCambiar la limpieza para llamar a dma_free_coherent() solo una vez en todo el búfer."}],"id":"CVE-2026-43149","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:32.553","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/011ae5dd84dc9f05eb9b8e1adff44252ac776e7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f85a9655445e67bb0238cfc983d7c383b54938e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36bd7d5deef936c4e1e3cd341598140e5c14c1d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6496fb830cbb741d831225cc4e7e5601c6e42970"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84b932bc9899d43e5829e6cf088b72d73a922b2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d68994e37ac3b285692559776e0279a88a3b5f8d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8a522085d09b30aba1016daf1dddac37c0f0285"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43150.json b/data/2026/CVE-2026-43150.json
index 1886aec6db..bd52a5c34d 100644
--- a/data/2026/CVE-2026-43150.json
+++ b/data/2026/CVE-2026-43150.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/perf/arm-cmn.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7e2c200010aa93fa78201da959b4ac6b9f8fed0b","status":"affected","version":"28fa550a49e818d6445e787f584759b1bf21d9d4","versionType":"git"},{"lessThan":"d3e837e11ee9ed08df229272319199003ba00379","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"00d69f21ef2ab00e6156c764d89e2b3539eb2f33","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"08c7eadd8a934a1968e1aeeee8b61b853b99fb3a","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"a251d866f50b6a4c95901fa722025065679c2eca","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"36c0de02575ce59dfd879eb4ef63d53a68bbf9ce","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"6.1.165","status":"affected","version":"6.1.63","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/perf/arm-cmn.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.5"},{"lessThan":"6.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AD1E11C2-5A82-49FA-B142-61E121FD4529","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.63","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A502C6C1-0CFB-4C9B-8A24-C76507206FA7","versionEndExcluding":"6.6.128","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we've been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere's no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too."}],"id":"CVE-2026-43150","lastModified":"2026-10-19T20:18:08.480","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:10.201472Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:32.690","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/perf/arm-cmn.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7e2c200010aa93fa78201da959b4ac6b9f8fed0b","status":"affected","version":"28fa550a49e818d6445e787f584759b1bf21d9d4","versionType":"git"},{"lessThan":"d3e837e11ee9ed08df229272319199003ba00379","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"00d69f21ef2ab00e6156c764d89e2b3539eb2f33","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"08c7eadd8a934a1968e1aeeee8b61b853b99fb3a","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"a251d866f50b6a4c95901fa722025065679c2eca","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"36c0de02575ce59dfd879eb4ef63d53a68bbf9ce","status":"affected","version":"7819e05a0dceac20c5ff78ec9b252faf3b76b824","versionType":"git"},{"lessThan":"6.1.165","status":"affected","version":"6.1.63","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/perf/arm-cmn.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.5"},{"lessThan":"6.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AD1E11C2-5A82-49FA-B142-61E121FD4529","versionEndExcluding":"6.1.165","versionStartIncluding":"6.1.63","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A502C6C1-0CFB-4C9B-8A24-C76507206FA7","versionEndExcluding":"6.6.128","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/arm-cmn: Reject unsupported hardware configurations\n\nSo far we've been fairly lax about accepting both unknown CMN models\n(at least with a warning), and unknown revisions of those which we\ndo know, as although things do frequently change between releases,\ntypically enough remains the same to be somewhat useful for at least\nsome basic bringup checks. However, we also make assumptions of the\nmaximum supported sizes and numbers of things in various places, and\nthere's no guarantee that something new might not be bigger and lead\nto nasty array overflows. Make sure we only try to run on things that\nactually match our assumptions and so will not risk memory corruption.\n\nWe have at least always failed on completely unknown node types, so\nupdate that error message for clarity and consistency too."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nperf/arm-cmn: Rechazar configuraciones de hardware no compatibles\n\nHasta ahora hemos sido bastante permisivos al aceptar tanto modelos CMN desconocidos (al menos con una advertencia) como revisiones desconocidas de aquellos que sí conocemos, ya que, aunque las cosas cambian con frecuencia entre versiones, normalmente lo suficiente permanece igual para ser algo útil para al menos algunas comprobaciones básicas de arranque. Sin embargo, también hacemos suposiciones sobre los tamaños máximos admitidos y el número de elementos en varios lugares, y no hay garantía de que algo nuevo no pueda ser más grande y provocar desbordamientos de array desagradables. Asegurémonos de que solo intentamos ejecutar en cosas que realmente coincidan con nuestras suposiciones y así no arriesgaremos la corrupción de memoria.\n\nAl menos siempre hemos fallado en tipos de nodos completamente desconocidos, así que actualicemos ese mensaje de error para mayor claridad y consistencia también."}],"id":"CVE-2026-43150","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:10.201472Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:32.690","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00d69f21ef2ab00e6156c764d89e2b3539eb2f33"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08c7eadd8a934a1968e1aeeee8b61b853b99fb3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36c0de02575ce59dfd879eb4ef63d53a68bbf9ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e2c200010aa93fa78201da959b4ac6b9f8fed0b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a251d866f50b6a4c95901fa722025065679c2eca"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3e837e11ee9ed08df229272319199003ba00379"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43151.json b/data/2026/CVE-2026-43151.json
index 320413a1cd..1d267c3cf4 100644
--- a/data/2026/CVE-2026-43151.json
+++ b/data/2026/CVE-2026-43151.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_vb2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bd4f8fa216182f33c06d4c1e162975a0c42fb14e","status":"affected","version":"f8b136296722e258ec43237a35f72c92a6d4501a","versionType":"git"},{"lessThan":"a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398","status":"affected","version":"ad699fa78b59241c9d71a8cafb51525f3dab04d4","versionType":"git"},{"lessThan":"370e19042fb8ac68109f8bdb0fdd8118baf39318","status":"affected","version":"ad699fa78b59241c9d71a8cafb51525f3dab04d4","versionType":"git"},{"lessThan":"6.18.16","status":"affected","version":"6.18.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_vb2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"467D065A-A7C4-4E16-81D4-A299BE23E234","versionEndExcluding":"6.18.16","versionStartIncluding":"6.18.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"media: iris: Add sanity check for stop streaming\"\n\nThis reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.\n\nRevert the check that skipped stop_streaming when the instance was in\nIRIS_INST_ERROR, as it caused multiple regressions:\n\n1. Buffers were not returned to vb2 when the instance was already in\n   error state, triggering warnings in the vb2 core because buffer\n   completion was skipped.\n\n2. If a session failed early (e.g. unsupported configuration), the\n   instance transitioned to IRIS_INST_ERROR. When userspace attempted\n   to stop streaming for cleanup, stop_streaming was skipped due to the\n   added check, preventing proper teardown and leaving the firmware\n   in an inconsistent state."}],"id":"CVE-2026-43151","lastModified":"2026-06-17T10:49:01.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:32.827","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/370e19042fb8ac68109f8bdb0fdd8118baf39318"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd4f8fa216182f33c06d4c1e162975a0c42fb14e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_vb2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bd4f8fa216182f33c06d4c1e162975a0c42fb14e","status":"affected","version":"f8b136296722e258ec43237a35f72c92a6d4501a","versionType":"git"},{"lessThan":"a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398","status":"affected","version":"ad699fa78b59241c9d71a8cafb51525f3dab04d4","versionType":"git"},{"lessThan":"370e19042fb8ac68109f8bdb0fdd8118baf39318","status":"affected","version":"ad699fa78b59241c9d71a8cafb51525f3dab04d4","versionType":"git"},{"lessThan":"6.18.16","status":"affected","version":"6.18.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/platform/qcom/iris/iris_vb2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"467D065A-A7C4-4E16-81D4-A299BE23E234","versionEndExcluding":"6.18.16","versionStartIncluding":"6.18.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"media: iris: Add sanity check for stop streaming\"\n\nThis reverts commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.\n\nRevert the check that skipped stop_streaming when the instance was in\nIRIS_INST_ERROR, as it caused multiple regressions:\n\n1. Buffers were not returned to vb2 when the instance was already in\n   error state, triggering warnings in the vb2 core because buffer\n   completion was skipped.\n\n2. If a session failed early (e.g. unsupported configuration), the\n   instance transitioned to IRIS_INST_ERROR. When userspace attempted\n   to stop streaming for cleanup, stop_streaming was skipped due to the\n   added check, preventing proper teardown and leaving the firmware\n   in an inconsistent state."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRevertir ’media: iris: Añadir comprobación de cordura para detener la transmisión’\n\nEsto revierte el commit ad699fa78b59241c9d71a8cafb51525f3dab04d4.\n\nRevertir la comprobación que omitía stop_streaming cuando la instancia estaba en IRIS_INST_ERROR, ya que causó múltiples regresiones:\n\n1. Los búferes no se devolvían a vb2 cuando la instancia ya estaba en estado de error, lo que activaba advertencias en el núcleo de vb2 porque se omitía la finalización del búfer.\n\n2. Si una sesión fallaba temprano (p. ej., configuración no compatible), la instancia pasaba a IRIS_INST_ERROR. Cuando el espacio de usuario intentaba detener la transmisión para la limpieza, stop_streaming se omitía debido a la comprobación añadida, lo que impedía un desmontaje adecuado y dejaba el firmware en un estado inconsistente."}],"id":"CVE-2026-43151","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:32.827","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/370e19042fb8ac68109f8bdb0fdd8118baf39318"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a58b9d1c1cf81c0b29f1983c63c3e0c0caa68398"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd4f8fa216182f33c06d4c1e162975a0c42fb14e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43152.json b/data/2026/CVE-2026-43152.json
index bdfc67309a..c706db1389 100644
--- a/data/2026/CVE-2026-43152.json
+++ b/data/2026/CVE-2026-43152.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-pl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"78df3de826668fe842c6061a91bc1ed68f493e80","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"8a84149337eb5e716e6d59f48ff0374dae8d8b2b","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"926e6715b48b575ed7754bf163a67686bb2eb111","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"449004434e1f55be85604b2645f2d07c4a92fe53","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"04e50f45b5175bb90a06f5003113cb4ed6ba44c2","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"1d46d07458dba369daf61fb643d40a62c8423d8e","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"7d2f4fdf134e7398847417b25743e1e04928c7d7","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"3756a272d2cf356d2203da8474d173257f5f8521","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-pl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.21"},{"lessThan":"2.6.21","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"579B78D3-F090-4CA0-818B-974070138E1B","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.21","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-pl: handle probe errors\n\nErrors in init must be reported back or we'll\nfollow a NULL pointer the first time FF is used."}],"id":"CVE-2026-43152","lastModified":"2026-11-06T16:18:25.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:46.962131Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:32.943","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/04e50f45b5175bb90a06f5003113cb4ed6ba44c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d46d07458dba369daf61fb643d40a62c8423d8e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3756a272d2cf356d2203da8474d173257f5f8521"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/449004434e1f55be85604b2645f2d07c4a92fe53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78df3de826668fe842c6061a91bc1ed68f493e80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7d2f4fdf134e7398847417b25743e1e04928c7d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a84149337eb5e716e6d59f48ff0374dae8d8b2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/926e6715b48b575ed7754bf163a67686bb2eb111"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-pl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"78df3de826668fe842c6061a91bc1ed68f493e80","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"8a84149337eb5e716e6d59f48ff0374dae8d8b2b","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"926e6715b48b575ed7754bf163a67686bb2eb111","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"449004434e1f55be85604b2645f2d07c4a92fe53","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"04e50f45b5175bb90a06f5003113cb4ed6ba44c2","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"1d46d07458dba369daf61fb643d40a62c8423d8e","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"7d2f4fdf134e7398847417b25743e1e04928c7d7","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"},{"lessThan":"3756a272d2cf356d2203da8474d173257f5f8521","status":"affected","version":"20eb12790670985c8e30821218993bd260387b89","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-pl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.21"},{"lessThan":"2.6.21","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"579B78D3-F090-4CA0-818B-974070138E1B","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.21","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-pl: handle probe errors\n\nErrors in init must be reported back or we'll\nfollow a NULL pointer the first time FF is used."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nHID: hid-pl: manejar errores de sondeo\n\nLos errores en la inicialización deben ser reportados o seguiremos un puntero NULL la primera vez que se use FF."}],"id":"CVE-2026-43152","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:46.962131Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:32.943","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/04e50f45b5175bb90a06f5003113cb4ed6ba44c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d46d07458dba369daf61fb643d40a62c8423d8e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3756a272d2cf356d2203da8474d173257f5f8521"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/449004434e1f55be85604b2645f2d07c4a92fe53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78df3de826668fe842c6061a91bc1ed68f493e80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7d2f4fdf134e7398847417b25743e1e04928c7d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a84149337eb5e716e6d59f48ff0374dae8d8b2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/926e6715b48b575ed7754bf163a67686bb2eb111"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43153.json b/data/2026/CVE-2026-43153.json
index 9c19bd8e6e..b8c75caf7f 100644
--- a/data/2026/CVE-2026-43153.json
+++ b/data/2026/CVE-2026-43153.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/libxfs/xfs_attr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dfb3474230d392f809359f15aeaa9be4b1798199","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"759e44a6cba8e81d945ffc269a326ec39e7f54f5","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"2fbc8421d1db102c0e5458607e042a23a03648b1","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"457121c01f609b9934addbb04d5c1ef638c71c61","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"530082df991903f3330354e99e0cb7b05debfa86","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"3a65ea768b8094e4699e72f9ab420eb9e0f3f568","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/libxfs/xfs_attr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F0FB6DE3-7F78-4DBC-83E3-1ACA0F4DC0E4","versionEndExcluding":"6.12.75","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: remove xfs_attr_leaf_hasname\n\nThe calling convention of xfs_attr_leaf_hasname() is problematic, because\nit returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer\nwhen xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a\nnon-NULL buffer pointer for an already released buffer when\nxfs_attr3_leaf_lookup_int fails with other error values.\n\nFix this by simply open coding xfs_attr_leaf_hasname in the callers, so\nthat the buffer release code is done by each caller of\nxfs_attr3_leaf_read."}],"id":"CVE-2026-43153","lastModified":"2026-10-30T13:18:47.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43153","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:12.446055Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:33.073","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2fbc8421d1db102c0e5458607e042a23a03648b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a65ea768b8094e4699e72f9ab420eb9e0f3f568"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/457121c01f609b9934addbb04d5c1ef638c71c61"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/530082df991903f3330354e99e0cb7b05debfa86"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/759e44a6cba8e81d945ffc269a326ec39e7f54f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dfb3474230d392f809359f15aeaa9be4b1798199"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/libxfs/xfs_attr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dfb3474230d392f809359f15aeaa9be4b1798199","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"759e44a6cba8e81d945ffc269a326ec39e7f54f5","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"2fbc8421d1db102c0e5458607e042a23a03648b1","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"457121c01f609b9934addbb04d5c1ef638c71c61","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"530082df991903f3330354e99e0cb7b05debfa86","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"},{"lessThan":"3a65ea768b8094e4699e72f9ab420eb9e0f3f568","status":"affected","version":"07120f1abdff80f3d1351f733661abe28d609535","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/libxfs/xfs_attr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F0FB6DE3-7F78-4DBC-83E3-1ACA0F4DC0E4","versionEndExcluding":"6.12.75","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: remove xfs_attr_leaf_hasname\n\nThe calling convention of xfs_attr_leaf_hasname() is problematic, because\nit returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer\nwhen xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a\nnon-NULL buffer pointer for an already released buffer when\nxfs_attr3_leaf_lookup_int fails with other error values.\n\nFix this by simply open coding xfs_attr_leaf_hasname in the callers, so\nthat the buffer release code is done by each caller of\nxfs_attr3_leaf_read."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfs: eliminar xfs_attr_leaf_hasname\n\nLa convención de llamada de xfs_attr_leaf_hasname() es problemática, porque devuelve un búfer NULL cuando xfs_attr3_leaf_read falla, un búfer válido cuando xfs_attr3_leaf_lookup_int devuelve -ENOATTR o -EEXIST, y un puntero de búfer no-NULL para un búfer ya liberado cuando xfs_attr3_leaf_lookup_int falla con otros valores de error.\n\nSolucione esto simplemente codificando abiertamente xfs_attr_leaf_hasname en los llamadores, para que el código de liberación del búfer sea realizado por cada llamador de xfs_attr3_leaf_read."}],"id":"CVE-2026-43153","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43153","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:12.446055Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:33.073","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2fbc8421d1db102c0e5458607e042a23a03648b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a65ea768b8094e4699e72f9ab420eb9e0f3f568"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/457121c01f609b9934addbb04d5c1ef638c71c61"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/530082df991903f3330354e99e0cb7b05debfa86"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/759e44a6cba8e81d945ffc269a326ec39e7f54f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dfb3474230d392f809359f15aeaa9be4b1798199"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43154.json b/data/2026/CVE-2026-43154.json
index 98347ccc46..fda27fd47f 100644
--- a/data/2026/CVE-2026-43154.json
+++ b/data/2026/CVE-2026-43154.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/erofs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8d8a878ef60801d867119b3df6a93e2982d62a71","status":"affected","version":"1cf12c7177410afcb53f815315d1247ea57fae4f","versionType":"git"},{"lessThan":"d498bd168494ad4a4bce16192bfb9ce04ca19c9a","status":"affected","version":"1cf12c7177410afcb53f815315d1247ea57fae4f","versionType":"git"},{"lessThan":"3afa4da38802a4cba1c23848a32284e7e57b831b","status":"affected","version":"1cf12c7177410afcb53f815315d1247ea57fae4f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/erofs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E0D300DB-AA68-4962-981D-EF9F5E97AACF","versionEndExcluding":"6.18.16","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix incorrect early exits in volume label handling\n\nCrafted EROFS images containing valid volume labels can trigger\nincorrect early returns, leading to folio reference leaks.\n\nHowever, this does not cause system crashes or other severe issues."}],"id":"CVE-2026-43154","lastModified":"2026-06-17T10:49:02.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:33.193","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3afa4da38802a4cba1c23848a32284e7e57b831b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d8a878ef60801d867119b3df6a93e2982d62a71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d498bd168494ad4a4bce16192bfb9ce04ca19c9a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/erofs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8d8a878ef60801d867119b3df6a93e2982d62a71","status":"affected","version":"1cf12c7177410afcb53f815315d1247ea57fae4f","versionType":"git"},{"lessThan":"d498bd168494ad4a4bce16192bfb9ce04ca19c9a","status":"affected","version":"1cf12c7177410afcb53f815315d1247ea57fae4f","versionType":"git"},{"lessThan":"3afa4da38802a4cba1c23848a32284e7e57b831b","status":"affected","version":"1cf12c7177410afcb53f815315d1247ea57fae4f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/erofs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E0D300DB-AA68-4962-981D-EF9F5E97AACF","versionEndExcluding":"6.18.16","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix incorrect early exits in volume label handling\n\nCrafted EROFS images containing valid volume labels can trigger\nincorrect early returns, leading to folio reference leaks.\n\nHowever, this does not cause system crashes or other severe issues."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nerofs: corrección de salidas tempranas incorrectas en el manejo de etiquetas de volumen\n\nImágenes EROFS manipuladas que contienen etiquetas de volumen válidas pueden desencadenar retornos tempranos incorrectos, lo que lleva a fugas de referencias de folio.\n\nSin embargo, esto no causa bloqueos del sistema u otros problemas graves."}],"id":"CVE-2026-43154","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:33.193","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3afa4da38802a4cba1c23848a32284e7e57b831b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d8a878ef60801d867119b3df6a93e2982d62a71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d498bd168494ad4a4bce16192bfb9ce04ca19c9a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43155.json b/data/2026/CVE-2026-43155.json
index dc47c14ba5..0f84e68c19 100644
--- a/data/2026/CVE-2026-43155.json
+++ b/data/2026/CVE-2026-43155.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mux/mmio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"76096f156fe9dc9fbd6e4618088706e91b9b0a6c","status":"affected","version":"61de83fd8256e185588670d3cf0bccc3e913819c","versionType":"git"},{"lessThan":"cbde3c109d52564ae2c12e514c33c44345e84b2c","status":"affected","version":"61de83fd8256e185588670d3cf0bccc3e913819c","versionType":"git"},{"lessThan":"3c4ae63073d84abee5d81ce46d86a94e9dae9c89","status":"affected","version":"61de83fd8256e185588670d3cf0bccc3e913819c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mux/mmio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4562EDA-AFEA-4C62-97CC-C83E109A5F19","versionEndExcluding":"6.18.16","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmux: mmio: fix regmap leak on probe failure\n\nThe mmio regmap that may be allocated during probe is never freed.\n\nSwitch to using the device managed allocator so that the regmap is\nreleased on probe failures (e.g. probe deferral) and on driver unbind."}],"id":"CVE-2026-43155","lastModified":"2026-06-17T10:49:02.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:33.310","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c4ae63073d84abee5d81ce46d86a94e9dae9c89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76096f156fe9dc9fbd6e4618088706e91b9b0a6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cbde3c109d52564ae2c12e514c33c44345e84b2c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mux/mmio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"76096f156fe9dc9fbd6e4618088706e91b9b0a6c","status":"affected","version":"61de83fd8256e185588670d3cf0bccc3e913819c","versionType":"git"},{"lessThan":"cbde3c109d52564ae2c12e514c33c44345e84b2c","status":"affected","version":"61de83fd8256e185588670d3cf0bccc3e913819c","versionType":"git"},{"lessThan":"3c4ae63073d84abee5d81ce46d86a94e9dae9c89","status":"affected","version":"61de83fd8256e185588670d3cf0bccc3e913819c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mux/mmio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4562EDA-AFEA-4C62-97CC-C83E109A5F19","versionEndExcluding":"6.18.16","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmux: mmio: fix regmap leak on probe failure\n\nThe mmio regmap that may be allocated during probe is never freed.\n\nSwitch to using the device managed allocator so that the regmap is\nreleased on probe failures (e.g. probe deferral) and on driver unbind."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmux: mmio: corregir fuga de regmap en fallo de sondeo\n\nEl regmap mmio que puede ser asignado durante el sondeo nunca es liberado.\n\nCambiar al uso del asignador gestionado por el dispositivo para que el regmap sea liberado en fallos de sondeo (p. ej., aplazamiento de sondeo) y en la desvinculación del controlador."}],"id":"CVE-2026-43155","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-06T12:16:33.310","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c4ae63073d84abee5d81ce46d86a94e9dae9c89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76096f156fe9dc9fbd6e4618088706e91b9b0a6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cbde3c109d52564ae2c12e514c33c44345e84b2c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43156.json b/data/2026/CVE-2026-43156.json
index 4823b4836c..90045ef2f3 100644
--- a/data/2026/CVE-2026-43156.json
+++ b/data/2026/CVE-2026-43156.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/pegasus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a3e64e950a3981a8199de9798f6d21261b959171","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"229dc9b9db475ac900182bafe258943e0e054c6d","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"26b3ec62fa1a94ac801feca47f040fc729b3c174","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"35854ed5c40b02f95824e44398f9d2ba33727203","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"67ba6b13dbcaf45681fb6758794c5ac5fa589a6c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"d2e7c898cc02dfe42443489a67a45ed616cb76e9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"2705709f6574a088aab246af72fc95f2fea51484","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"3d7e6ce34f4fcc7083510c28b17a7c36462a25d4","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/pegasus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"68B6D2AD-7565-4394-B77B-A1EEBCDF590F","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: enable basic endpoint checking\n\npegasus_probe() fills URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n  - usb_rcvbulkpipe(dev, 1) for RX data\n  - usb_sndbulkpipe(dev, 2) for TX data\n  - usb_rcvintpipe(dev, 3)  for status interrupts\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a pegasus_usb_ep enum for endpoint numbers, replacing magic\nconstants throughout. Add usb_check_bulk_endpoints() and\nusb_check_int_endpoints() calls before any resource allocation to\nverify endpoint types before use, rejecting devices with mismatched\ndescriptors at probe time, and avoid triggering assertion.\n\nSimilar fix to\n- commit 90b7f2961798 (\"net: usb: rtl8150: enable basic endpoint checking\")\n- commit 9e7021d2aeae (\"net: usb: catc: enable basic endpoint checking\")"}],"id":"CVE-2026-43156","lastModified":"2026-11-06T16:18:25.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43156","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:51.233976Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:33.427","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/229dc9b9db475ac900182bafe258943e0e054c6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26b3ec62fa1a94ac801feca47f040fc729b3c174"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2705709f6574a088aab246af72fc95f2fea51484"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35854ed5c40b02f95824e44398f9d2ba33727203"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d7e6ce34f4fcc7083510c28b17a7c36462a25d4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67ba6b13dbcaf45681fb6758794c5ac5fa589a6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3e64e950a3981a8199de9798f6d21261b959171"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2e7c898cc02dfe42443489a67a45ed616cb76e9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/pegasus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a3e64e950a3981a8199de9798f6d21261b959171","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"229dc9b9db475ac900182bafe258943e0e054c6d","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"26b3ec62fa1a94ac801feca47f040fc729b3c174","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"35854ed5c40b02f95824e44398f9d2ba33727203","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"67ba6b13dbcaf45681fb6758794c5ac5fa589a6c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"d2e7c898cc02dfe42443489a67a45ed616cb76e9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"2705709f6574a088aab246af72fc95f2fea51484","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"3d7e6ce34f4fcc7083510c28b17a7c36462a25d4","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/pegasus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"68B6D2AD-7565-4394-B77B-A1EEBCDF590F","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: enable basic endpoint checking\n\npegasus_probe() fills URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n  - usb_rcvbulkpipe(dev, 1) for RX data\n  - usb_sndbulkpipe(dev, 2) for TX data\n  - usb_rcvintpipe(dev, 3)  for status interrupts\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a pegasus_usb_ep enum for endpoint numbers, replacing magic\nconstants throughout. Add usb_check_bulk_endpoints() and\nusb_check_int_endpoints() calls before any resource allocation to\nverify endpoint types before use, rejecting devices with mismatched\ndescriptors at probe time, and avoid triggering assertion.\n\nSimilar fix to\n- commit 90b7f2961798 (\"net: usb: rtl8150: enable basic endpoint checking\")\n- commit 9e7021d2aeae (\"net: usb: catc: enable basic endpoint checking\")"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: usb: pegasus: habilitar la comprobación básica de puntos finales\n\npegasus_probe() llena URBs con tuberías de punto final codificadas sin verificar los descriptores de punto final:\n\n  - usb_rcvbulkpipe(dev, 1) para datos RX\n  - usb_sndbulkpipe(dev, 2) para datos TX\n  - usb_rcvintpipe(dev, 3) para interrupciones de estado\n\nUn dispositivo USB malformado puede presentar estos puntos finales con tipos de transferencia que difieren de lo que el controlador asume.\n\nAñadir una enumeración pegasus_usb_ep para números de punto final, reemplazando constantes mágicas en todo el código. Añadir llamadas a usb_check_bulk_endpoints() y usb_check_int_endpoints() antes de cualquier asignación de recursos para verificar los tipos de punto final antes de su uso, rechazando dispositivos con descriptores no coincidentes en el momento de la sonda, y evitar activar una aserción.\n\nSolución similar a\n- commit 90b7f2961798 (’net: usb: rtl8150: habilitar la comprobación básica de puntos finales’)\n- commit 9e7021d2aeae (’net: usb: catc: habilitar la comprobación básica de puntos finales’)"}],"id":"CVE-2026-43156","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43156","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:51.233976Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:33.427","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/229dc9b9db475ac900182bafe258943e0e054c6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26b3ec62fa1a94ac801feca47f040fc729b3c174"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2705709f6574a088aab246af72fc95f2fea51484"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35854ed5c40b02f95824e44398f9d2ba33727203"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d7e6ce34f4fcc7083510c28b17a7c36462a25d4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67ba6b13dbcaf45681fb6758794c5ac5fa589a6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3e64e950a3981a8199de9798f6d21261b959171"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2e7c898cc02dfe42443489a67a45ed616cb76e9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43157.json b/data/2026/CVE-2026-43157.json
index 3608ad1fe3..53d4c533ef 100644
--- a/data/2026/CVE-2026-43157.json
+++ b/data/2026/CVE-2026-43157.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/cgx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ad8a13a45c5c24d0d32de9a1c3fd58498a675ece","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"013ac469596a0b8671e62d89c89ae0bd46bbe667","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"ccef79af58b43787c25710c9da96651c6ddfe50f","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"6d389382ee655128056fbdab86baad8495ffbf33","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"ccca14bbdcc25829d355b9f4d3249f43dadb71c1","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"3def995c4ede842adf509c410e92d09a0cedc965","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/cgx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3B9A8D13-BEFF-47C0-956C-415602FDDAAF","versionEndExcluding":"6.1.165","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: CGX: fix bitmap leaks\n\nThe RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)\nare allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().\nUnbinding and rebinding the driver therefore triggers kmemleak:\n\n    unreferenced object (size 16):\n        backtrace:\n          rvu_alloc_bitmap\n          cgx_probe\n\nFree both bitmaps during teardown."}],"id":"CVE-2026-43157","lastModified":"2026-11-06T16:18:26.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:55.478487Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:33.563","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/013ac469596a0b8671e62d89c89ae0bd46bbe667"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3def995c4ede842adf509c410e92d09a0cedc965"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d389382ee655128056fbdab86baad8495ffbf33"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad8a13a45c5c24d0d32de9a1c3fd58498a675ece"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ccca14bbdcc25829d355b9f4d3249f43dadb71c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ccef79af58b43787c25710c9da96651c6ddfe50f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/cgx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ad8a13a45c5c24d0d32de9a1c3fd58498a675ece","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"013ac469596a0b8671e62d89c89ae0bd46bbe667","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"ccef79af58b43787c25710c9da96651c6ddfe50f","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"6d389382ee655128056fbdab86baad8495ffbf33","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"ccca14bbdcc25829d355b9f4d3249f43dadb71c1","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"},{"lessThan":"3def995c4ede842adf509c410e92d09a0cedc965","status":"affected","version":"e740003874edc13e468d19233f99787bedb4bb8e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/cgx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3B9A8D13-BEFF-47C0-956C-415602FDDAAF","versionEndExcluding":"6.1.165","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: CGX: fix bitmap leaks\n\nThe RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)\nare allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().\nUnbinding and rebinding the driver therefore triggers kmemleak:\n\n    unreferenced object (size 16):\n        backtrace:\n          rvu_alloc_bitmap\n          cgx_probe\n\nFree both bitmaps during teardown."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nocteontx2-af: CGX: corregir fugas de mapas de bits\n\nLos mapas de bits de control de flujo RX/TX (rx_fc_pfvf_bmap y tx_fc_pfvf_bmap)\nson asignados por cgx_lmac_init() pero nunca liberados en cgx_lmac_exit().\nDesvincular y volver a vincular el controlador, por lo tanto, activa kmemleak:\n\n    objeto sin referencia (tamaño 16):\n        rastreo de pila:\n          rvu_alloc_bitmap\n          cgx_probe\n\nLiberar ambos mapas de bits durante el desmontaje."}],"id":"CVE-2026-43157","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:29:55.478487Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:33.563","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/013ac469596a0b8671e62d89c89ae0bd46bbe667"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3def995c4ede842adf509c410e92d09a0cedc965"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d389382ee655128056fbdab86baad8495ffbf33"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad8a13a45c5c24d0d32de9a1c3fd58498a675ece"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ccca14bbdcc25829d355b9f4d3249f43dadb71c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ccef79af58b43787c25710c9da96651c6ddfe50f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43158.json b/data/2026/CVE-2026-43158.json
index 9110297ed0..b58a5c21b4 100644
--- a/data/2026/CVE-2026-43158.json
+++ b/data/2026/CVE-2026-43158.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/libxfs/xfs_attr_leaf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d08976725355b9d54d8332fce223fa281cc304a5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6a8737afbccc340e718e0b22577312826390be8b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a396b3d73d51355e50acdb403ba9c4cae4c1174e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"38613c01f69e1e77e6b8acab1e8ac665d01c2f15","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ef42a8766ff3fdf51cf72fb36d0859c09d134478","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"43f3b18679615a93bd848afde3602ba160637a46","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"24ce71852f2cee6581e2cbebc15489ed52bf63b7","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"3eefc0c2b78444b64feeb3783c017d6adc3cd3ce","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/libxfs/xfs_attr_leaf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"68B6D2AD-7565-4394-B77B-A1EEBCDF590F","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix freemap adjustments when adding xattrs to leaf blocks\n\nxfs/592 and xfs/794 both trip this assertion in the leaf block freemap\nadjustment code after ~20 minutes of running on my test VMs:\n\n ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)\n\t\t\t\t\t+ xfs_attr3_leaf_hdr_size(leaf));\n\nUpon enabling quite a lot more debugging code, I narrowed this down to\nfsstress trying to set a local extended attribute with namelen=3 and\nvaluelen=71.  This results in an entry size of 80 bytes.\n\nAt the start of xfs_attr3_leaf_add_work, the freemap looks like this:\n\ni 0 base 448 size 0 rhs 448 count 46\ni 1 base 388 size 132 rhs 448 count 46\ni 2 base 2120 size 4 rhs 448 count 46\nfirstused = 520\n\nwhere \"rhs\" is the first byte past the end of the leaf entry array.\nThis is inconsistent -- the entries array ends at byte 448, but\nfreemap[1] says there's free space starting at byte 388!\n\nBy the end of the function, the freemap is in worse shape:\n\ni 0 base 456 size 0 rhs 456 count 47\ni 1 base 388 size 52 rhs 456 count 47\ni 2 base 2120 size 4 rhs 456 count 47\nfirstused = 440\n\nImportant note: 388 is not aligned with the entries array element size\nof 8 bytes.\n\nBased on the incorrect freemap, the name area starts at byte 440, which\nis below the end of the entries array!  That's why the assertion\ntriggers and the filesystem shuts down.\n\nHow did we end up here?  First, recall from the previous patch that the\nfreemap array in an xattr leaf block is not intended to be a\ncomprehensive map of all free space in the leaf block.  In other words,\nit's perfectly legal to have a leaf block with:\n\n * 376 bytes in use by the entries array\n * freemap[0] has [base = 376, size = 8]\n * freemap[1] has [base = 388, size = 1500]\n * the space between 376 and 388 is free, but the freemap stopped\n   tracking that some time ago\n\nIf we add one xattr, the entries array grows to 384 bytes, and\nfreemap[0] becomes [base = 384, size = 0].  So far, so good.  But if we\nadd a second xattr, the entries array grows to 392 bytes, and freemap[0]\ngets pushed up to [base = 392, size = 0].  This is bad, because\nfreemap[1] hasn't been updated, and now the entries array and the free\nspace claim the same space.\n\nThe fix here is to adjust all freemap entries so that none of them\ncollide with the entries array.  Note that this fix relies on commit\n2a2b5932db6758 (\"xfs: fix attr leaf header freemap.size underflow\") and\nthe previous patch that resets zero length freemap entries to have\nbase = 0."}],"id":"CVE-2026-43158","lastModified":"2026-10-19T20:18:08.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:15.222436Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:33.697","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24ce71852f2cee6581e2cbebc15489ed52bf63b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38613c01f69e1e77e6b8acab1e8ac665d01c2f15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3eefc0c2b78444b64feeb3783c017d6adc3cd3ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/43f3b18679615a93bd848afde3602ba160637a46"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6a8737afbccc340e718e0b22577312826390be8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a396b3d73d51355e50acdb403ba9c4cae4c1174e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d08976725355b9d54d8332fce223fa281cc304a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef42a8766ff3fdf51cf72fb36d0859c09d134478"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-664"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/libxfs/xfs_attr_leaf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d08976725355b9d54d8332fce223fa281cc304a5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6a8737afbccc340e718e0b22577312826390be8b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a396b3d73d51355e50acdb403ba9c4cae4c1174e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"38613c01f69e1e77e6b8acab1e8ac665d01c2f15","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ef42a8766ff3fdf51cf72fb36d0859c09d134478","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"43f3b18679615a93bd848afde3602ba160637a46","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"24ce71852f2cee6581e2cbebc15489ed52bf63b7","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"3eefc0c2b78444b64feeb3783c017d6adc3cd3ce","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/libxfs/xfs_attr_leaf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.252","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.202","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.165","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.128","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.75","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.16","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"68B6D2AD-7565-4394-B77B-A1EEBCDF590F","versionEndExcluding":"5.10.252","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4002FC2B-1456-4666-B240-0EBF590C4671","versionEndExcluding":"5.15.202","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654","versionEndExcluding":"6.1.165","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"851E9353-6C09-4CC9-877E-E09DB164A3C2","versionEndExcluding":"6.6.128","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BCE16369-98ED-41CF-8995-DFDC10B288D2","versionEndExcluding":"6.12.75","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B","versionEndExcluding":"6.18.16","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67","versionEndExcluding":"6.19.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix freemap adjustments when adding xattrs to leaf blocks\n\nxfs/592 and xfs/794 both trip this assertion in the leaf block freemap\nadjustment code after ~20 minutes of running on my test VMs:\n\n ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)\n\t\t\t\t\t+ xfs_attr3_leaf_hdr_size(leaf));\n\nUpon enabling quite a lot more debugging code, I narrowed this down to\nfsstress trying to set a local extended attribute with namelen=3 and\nvaluelen=71.  This results in an entry size of 80 bytes.\n\nAt the start of xfs_attr3_leaf_add_work, the freemap looks like this:\n\ni 0 base 448 size 0 rhs 448 count 46\ni 1 base 388 size 132 rhs 448 count 46\ni 2 base 2120 size 4 rhs 448 count 46\nfirstused = 520\n\nwhere \"rhs\" is the first byte past the end of the leaf entry array.\nThis is inconsistent -- the entries array ends at byte 448, but\nfreemap[1] says there's free space starting at byte 388!\n\nBy the end of the function, the freemap is in worse shape:\n\ni 0 base 456 size 0 rhs 456 count 47\ni 1 base 388 size 52 rhs 456 count 47\ni 2 base 2120 size 4 rhs 456 count 47\nfirstused = 440\n\nImportant note: 388 is not aligned with the entries array element size\nof 8 bytes.\n\nBased on the incorrect freemap, the name area starts at byte 440, which\nis below the end of the entries array!  That's why the assertion\ntriggers and the filesystem shuts down.\n\nHow did we end up here?  First, recall from the previous patch that the\nfreemap array in an xattr leaf block is not intended to be a\ncomprehensive map of all free space in the leaf block.  In other words,\nit's perfectly legal to have a leaf block with:\n\n * 376 bytes in use by the entries array\n * freemap[0] has [base = 376, size = 8]\n * freemap[1] has [base = 388, size = 1500]\n * the space between 376 and 388 is free, but the freemap stopped\n   tracking that some time ago\n\nIf we add one xattr, the entries array grows to 384 bytes, and\nfreemap[0] becomes [base = 384, size = 0].  So far, so good.  But if we\nadd a second xattr, the entries array grows to 392 bytes, and freemap[0]\ngets pushed up to [base = 392, size = 0].  This is bad, because\nfreemap[1] hasn't been updated, and now the entries array and the free\nspace claim the same space.\n\nThe fix here is to adjust all freemap entries so that none of them\ncollide with the entries array.  Note that this fix relies on commit\n2a2b5932db6758 (\"xfs: fix attr leaf header freemap.size underflow\") and\nthe previous patch that resets zero length freemap entries to have\nbase = 0."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfs: soluciona los ajustes del freemap al añadir xattrs a bloques hoja\n\nxfs/592 y xfs/794 ambos activan esta aserción en el código de ajuste del freemap del bloque hoja después de ~20 minutos de ejecución en mis máquinas virtuales de prueba:\n\n ASSERT(ichdr  ->  firstused >= ichdr  ->  count * sizeof(xfs_attr_leaf_entry_t)\n\t\t\t\t\t+ xfs_attr3_leaf_hdr_size(leaf));\n\nAl habilitar mucho más código de depuración, lo reduje a fsstress intentando establecer un atributo extendido local con namelen=3 y valuelen=71. Esto resulta en un tamaño de entrada de 80 bytes.\n\nAl inicio de xfs_attr3_leaf_add_work, el freemap se ve así:\n\ni 0 base 448 size 0 rhs 448 count 46\ni 1 base 388 size 132 rhs 448 count 46\ni 2 base 2120 size 4 rhs 448 count 46\nfirstused = 520\n\ndonde ’rhs’ es el primer byte después del final del array de entradas de la hoja. Esto es inconsistente: el array de entradas termina en el byte 448, ¡pero freemap[1] dice que hay espacio libre a partir del byte 388!\n\nAl final de la función, el freemap está en peor estado:\n\ni 0 base 456 size 0 rhs 456 count 47\ni 1 base 388 size 52 rhs 456 count 47\ni 2 base 2120 size 4 rhs 456 count 47\nfirstused = 440\n\nNota importante: 388 no está alineado con el tamaño de elemento del array de entradas de 8 bytes.\n\nBasado en el freemap incorrecto, el área de nombres comienza en el byte 440, ¡lo cual está por debajo del final del array de entradas! Por eso la aserción se activa y el sistema de archivos se apaga.\n\n¿Cómo llegamos a esto? Primero, recordemos del parche anterior que el array freemap en un bloque hoja xattr no está destinado a ser un mapa exhaustivo de todo el espacio libre en el bloque hoja. En otras palabras, es perfectamente legal tener un bloque hoja con:\n\n * 376 bytes en uso por el array de entradas\n * freemap[0] tiene [base = 376, size = 8]\n * freemap[1] tiene [base = 388, size = 1500]\n * el espacio entre 376 y 388 está libre, pero el freemap dejó de rastrearlo hace algún tiempo\n\nSi añadimos un xattr, el array de entradas crece a 384 bytes, y freemap[0] se convierte en [base = 384, size = 0]. Hasta ahora, todo bien. Pero si añadimos un segundo xattr, el array de entradas crece a 392 bytes, y freemap[0] se desplaza a [base = 392, size = 0]. Esto es malo, porque freemap[1] no ha sido actualizado, y ahora el array de entradas y el espacio libre reclaman el mismo espacio.\n\nLa solución aquí es ajustar todas las entradas del freemap para que ninguna de ellas colisione con el array de entradas. Tenga en cuenta que esta solución se basa en el commit 2a2b5932db6758 (’xfs: corrige el desbordamiento negativo de freemap.size del encabezado de la hoja de atributos’) y el parche anterior que restablece las entradas del freemap de longitud cero para que tengan base = 0."}],"id":"CVE-2026-43158","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:15:15.222436Z","version":"2.0.3"}}]},"published":"2026-05-06T12:16:33.697","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24ce71852f2cee6581e2cbebc15489ed52bf63b7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38613c01f69e1e77e6b8acab1e8ac665d01c2f15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3eefc0c2b78444b64feeb3783c017d6adc3cd3ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/43f3b18679615a93bd848afde3602ba160637a46"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6a8737afbccc340e718e0b22577312826390be8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a396b3d73d51355e50acdb403ba9c4cae4c1174e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d08976725355b9d54d8332fce223fa281cc304a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef42a8766ff3fdf51cf72fb36d0859c09d134478"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-664"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43529.json b/data/2026/CVE-2026-43529.json
index 4e23f4e25d..989e578108 100644
--- a/data/2026/CVE-2026-43529.json
+++ b/data/2026/CVE-2026-43529.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.10","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.10","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"5B7C767E-3450-421C-BD9F-9CE0D760A0E5","versionEndExcluding":"2026.4.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can race-condition swap the target file between validation and preflight read, causing the validator to inspect a different file identity than the one that passed the initial boundary check."}],"id":"CVE-2026-43529","lastModified":"2026-06-17T10:49:51.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T12:18:03.440322Z","version":"2.0.3"}}]},"published":"2026-05-05T12:16:19.057","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/b024fae9e5df43e9b69b2daebb72be3469d52e91"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gj9q-8w99-mp8j"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-time-of-check-time-of-use-toctou-race-condition-in-exec-script-preflight-validator"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.10","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.10","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"5B7C767E-3450-421C-BD9F-9CE0D760A0E5","versionEndExcluding":"2026.4.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can race-condition swap the target file between validation and preflight read, causing the validator to inspect a different file identity than the one that passed the initial boundary check."},{"lang":"es","value":"OpenClaw anterior a 2026.4.10 contiene una vulnerabilidad de tiempo de verificación-tiempo de uso en la función validateScriptFileForShellBleed que permite a atacantes locales eludir las comprobaciones de límites del espacio de trabajo. Un atacante con acceso de escritura al espacio de trabajo puede intercambiar el archivo objetivo en una condición de carrera entre la validación y la lectura previa, haciendo que el validador inspeccione una identidad de archivo diferente de la que pasó la comprobación de límites inicial."}],"id":"CVE-2026-43529","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T12:18:03.440322Z","version":"2.0.3"}}]},"published":"2026-05-05T12:16:19.057","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/b024fae9e5df43e9b69b2daebb72be3469d52e91"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gj9q-8w99-mp8j"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-time-of-check-time-of-use-toctou-race-condition-in-exec-script-preflight-validator"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-43573.json b/data/2026/CVE-2026-43573.json
index 76222a3b5b..169d75dbd9 100644
--- a/data/2026/CVE-2026-43573.json
+++ b/data/2026/CVE-2026-43573.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.10","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.10","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"5B7C767E-3450-421C-BD9F-9CE0D760A0E5","versionEndExcluding":"2026.4.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement."}],"id":"CVE-2026-43573","lastModified":"2026-06-17T10:49:53.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T13:49:59.528059Z","version":"2.0.3"}}]},"published":"2026-05-05T12:16:21.163","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/daeb74920d5ad986cb600625180037e23221e93a"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-527m-976r-jf79"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-ssrf-policy-bypass-in-existing-session-browser-interaction-routes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-918"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.10","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.10","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"5B7C767E-3450-421C-BD9F-9CE0D760A0E5","versionEndExcluding":"2026.4.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement."},{"lang":"es","value":"OpenClaw anterior a 2026.4.10 contiene una vulnerabilidad de omisión de política de falsificación de petición del lado del servidor en rutas de interacción del navegador de sesión existente. Los atacantes pueden omitir las protecciones de navegación de SSRF para interactuar con o navegar a objetivos no autorizados sin aplicación de políticas."}],"id":"CVE-2026-43573","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43573","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T13:49:59.528059Z","version":"2.0.3"}}]},"published":"2026-05-05T12:16:21.163","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/daeb74920d5ad986cb600625180037e23221e93a"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-527m-976r-jf79"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-ssrf-policy-bypass-in-existing-session-browser-interaction-routes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-918"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-43574.json b/data/2026/CVE-2026-43574.json
index 436b66edde..5ea799ce45 100644
--- a/data/2026/CVE-2026-43574.json
+++ b/data/2026/CVE-2026-43574.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.12","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.12","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"7BF70E95-4F37-4906-AC4D-D5CD17A5214D","versionEndExcluding":"2026.4.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. Attackers can resolve pending approvals without proper authorization by exploiting this logic flaw if they know an approval id."}],"id":"CVE-2026-43574","lastModified":"2026-06-17T10:49:53.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T12:19:51.078389Z","version":"2.0.3"}}]},"published":"2026-05-05T12:16:21.307","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/0a105c0900de701d2ee9f1abc96b017afbd0afdd"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-49cg-279w-m73x"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-improper-authorization-via-empty-approver-lists"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-183"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.12","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.12","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"7BF70E95-4F37-4906-AC4D-D5CD17A5214D","versionEndExcluding":"2026.4.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. Attackers can resolve pending approvals without proper authorization by exploiting this logic flaw if they know an approval id."},{"lang":"es","value":"OpenClaw anterior a 2026.4.12 contiene una vulnerabilidad de autorización indebida en canales respaldados por ayudantes donde las listas de aprobadores resueltas vacías se interpretan como autorización de aprobación explícita. Los atacantes pueden resolver aprobaciones pendientes sin la autorización adecuada explotando este fallo lógico si conocen un ID de aprobación."}],"id":"CVE-2026-43574","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T12:19:51.078389Z","version":"2.0.3"}}]},"published":"2026-05-05T12:16:21.307","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/0a105c0900de701d2ee9f1abc96b017afbd0afdd"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-49cg-279w-m73x"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-improper-authorization-via-empty-approver-lists"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-183"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5401.json b/data/2026/CVE-2026-5401.json
index 514f1aecf0..d846277b93 100644
--- a/data/2026/CVE-2026-5401.json
+++ b/data/2026/CVE-2026-5401.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-5401","lastModified":"2026-06-17T10:58:57.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5401","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T13:00:37.649384Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:37.720","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21088"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-13.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21088"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"AFP Spotlight protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo AFP Spotlight en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-5401","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5401","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T13:00:37.649384Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:37.720","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21088"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-13.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21088"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5403.json b/data/2026/CVE-2026-5403.json
index 6a370eef66..bef48a5259 100644
--- a/data/2026/CVE-2026-5403.json
+++ b/data/2026/CVE-2026-5403.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"wireshark","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution"}],"id":"CVE-2026-5403","lastModified":"2026-07-15T01:16:41.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-05-01T00:16:24.670","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21103"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-16.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-5403"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464271"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5403.json"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-122"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"wireshark","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution"},{"lang":"es","value":"El bloqueo del códec SBC en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio y posible ejecución de código"}],"id":"CVE-2026-5403","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-05-01T00:16:24.670","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21103"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-16.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-5403"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464271"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5403.json"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-122"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5404.json b/data/2026/CVE-2026-5404.json
index dd28bb83ff..4c1db46a4c 100644
--- a/data/2026/CVE-2026-5404.json
+++ b/data/2026/CVE-2026-5404.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"K12 RF5 file parser crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-5404","lastModified":"2026-06-17T10:58:58.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:19:54.078154Z","version":"2.0.3"}}]},"published":"2026-05-01T00:16:24.820","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21094"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-15.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"K12 RF5 file parser crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Caída del analizador de archivos K12 RF5 en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-5404","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:19:54.078154Z","version":"2.0.3"}}]},"published":"2026-05-01T00:16:24.820","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21094"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-15.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5406.json b/data/2026/CVE-2026-5406.json
index 36f4050f18..fe051f3d55 100644
--- a/data/2026/CVE-2026-5406.json
+++ b/data/2026/CVE-2026-5406.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-5406","lastModified":"2026-06-17T10:58:58.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5406","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:55:40.481166Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:37.990","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21070"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-10.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21070"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"La caída del disector del protocolo FC-SWILS en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-5406","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5406","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:55:40.481166Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:37.990","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21070"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-10.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21070"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5407.json b/data/2026/CVE-2026-5407.json
index 466b39a2be..70d72d746f 100644
--- a/data/2026/CVE-2026-5407.json
+++ b/data/2026/CVE-2026-5407.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SMB2 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-5407","lastModified":"2026-06-17T10:58:58.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5407","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:54:15.707110Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.140","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21073"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-11.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21073"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SMB2 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Disector del protocolo SMB2 con bucle infinito en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-5407","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5407","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:54:15.707110Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.140","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21073"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-11.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21073"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5408.json b/data/2026/CVE-2026-5408.json
index 29f247667d..b15d52d261 100644
--- a/data/2026/CVE-2026-5408.json
+++ b/data/2026/CVE-2026-5408.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-5408","lastModified":"2026-06-17T10:58:58.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5408","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:51:29.707385Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.263","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21067"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-09.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21067"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo BT-DHT en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-5408","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5408","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:51:29.707385Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.263","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21067"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-09.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21067"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5409.json b/data/2026/CVE-2026-5409.json
index e8c69207c0..a58cbe328b 100644
--- a/data/2026/CVE-2026-5409.json
+++ b/data/2026/CVE-2026-5409.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-5409","lastModified":"2026-06-17T10:58:58.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5409","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:57:30.358494Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.383","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21066"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-08.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21066"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo Monero en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-5409","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5409","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:57:30.358494Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.383","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21066"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-08.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21066"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5653.json b/data/2026/CVE-2026-5653.json
index 6fb6ce3b16..25405dde1a 100644
--- a/data/2026/CVE-2026-5653.json
+++ b/data/2026/CVE-2026-5653.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-5653","lastModified":"2026-06-17T10:59:27.247","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5653","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:50:46.869847Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.520","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21122"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-22.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21122"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo DCP-ETSI en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-5653","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5653","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:50:46.869847Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.520","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21122"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-22.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21122"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5655.json b/data/2026/CVE-2026-5655.json
index a29f447365..acbc8184bb 100644
--- a/data/2026/CVE-2026-5655.json
+++ b/data/2026/CVE-2026-5655.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 allows denial of service"}],"id":"CVE-2026-5655","lastModified":"2026-06-17T10:59:27.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5655","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:52:18.578076Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.780","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21112"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-19.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21112"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 allows denial of service"},{"lang":"es","value":"Bloqueo del disector del protocolo SDP en Wireshark 4.6.0 a 4.6.4 permite denegación de servicio"}],"id":"CVE-2026-5655","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5655","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:52:18.578076Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.780","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21112"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-19.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21112"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5656.json b/data/2026/CVE-2026-5656.json
index 8633b44d6c..f9c61e1da0 100644
--- a/data/2026/CVE-2026-5656.json
+++ b/data/2026/CVE-2026-5656.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"wireshark","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:4.4.2-10.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"wireshark","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:4.4.2-3.el10_0.4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution"}],"id":"CVE-2026-5656","lastModified":"2026-07-15T01:16:43.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5656","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-05-01T00:16:25.097","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21115"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-21.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:20600"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:26182"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-5656"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464276"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5656.json"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cve@gitlab.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"wireshark","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:4.4.2-10.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"wireshark","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:4.4.2-3.el10_0.4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"wireshark","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution"},{"lang":"es","value":"Salto de ruta en la importación de perfiles en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio y posible ejecución de código."}],"id":"CVE-2026-5656","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5656","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-05-01T00:16:25.097","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21115"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-21.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:20600"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:26182"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-5656"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464276"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5656.json"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cve@gitlab.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-5657.json b/data/2026/CVE-2026-5657.json
index 406e99678a..9132e8f9df 100644
--- a/data/2026/CVE-2026-5657.json
+++ b/data/2026/CVE-2026-5657.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-5657","lastModified":"2026-06-17T10:59:27.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5657","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:45:03.269150Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.907","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21113"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-20.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21113"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Bloqueo del códec iLBC en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-5657","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5657","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:45:03.269150Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:38.907","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21113"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-20.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21113"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6238.json b/data/2026/CVE-2026-6238.json
index f40bd99eb0..8a8912a956 100644
--- a/data/2026/CVE-2026-6238.json
+++ b/data/2026/CVE-2026-6238.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.43","status":"affected","version":"2.0.1","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*","matchCriteriaId":"E6240DD2-E366-424F-BFA2-266E17793764","versionStartIncluding":"2.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}],"id":"CVE-2026-6238","lastModified":"2026-07-14T13:19:09.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6238","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-28T18:51:21.285963Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:47.523","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","tags":["Third Party Advisory"],"url":"https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","tags":["Issue Tracking"],"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34069"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.43","status":"affected","version":"2.0.1","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.6","status":"affected","version":"V3.1.5","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*","matchCriteriaId":"E6240DD2-E366-424F-BFA2-266E17793764","versionStartIncluding":"2.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."},{"lang":"es","value":"Las funciones obsoletas ns_printrrf, ns_printrr y fp_nquery en la GNU C Library versión 2.2 y posteriores no validan el contenido RDATA contra la longitud RDATA en una respuesta DNS al procesar registros LOC, CERT, TKEY o TSIG, lo que puede permitir a un atacante crear una respuesta DNS, causando que una aplicación objetivo se bloquee o lea memoria no inicializada.\n\nEstas funciones son solo para depuración de aplicaciones y por lo tanto no están en la ruta del código ejecutado por el resolvedor DNS. Además, han sido obsoletas desde la versión 2.34 y no deben ser utilizadas por ninguna aplicación nueva. Las aplicaciones deberían considerar migrar fuera de estas interfaces ya que pueden ser eliminadas en versiones futuras."}],"id":"CVE-2026-6238","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6238","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-28T18:51:21.285963Z","version":"2.0.3"}}]},"published":"2026-04-28T19:37:47.523","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","tags":["Third Party Advisory"],"url":"https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","tags":["Issue Tracking"],"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34069"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6521.json b/data/2026/CVE-2026-6521.json
index df54743729..1a3ebc594e 100644
--- a/data/2026/CVE-2026-6521.json
+++ b/data/2026/CVE-2026-6521.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenFlow v5 protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6521","lastModified":"2026-06-17T11:00:55.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T15:03:45.975605Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:39.273","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21182"},{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21188"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-39.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenFlow v5 protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"El disector del protocolo OpenFlow v5 con bucles infinitos en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-6521","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T15:03:45.975605Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:39.273","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21182"},{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21188"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-39.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6523.json b/data/2026/CVE-2026-6523.json
index 0bc2b70dc1..c6d81db7a1 100644
--- a/data/2026/CVE-2026-6523.json
+++ b/data/2026/CVE-2026-6523.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"GNW protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6523","lastModified":"2026-06-17T11:00:55.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T15:03:15.757283Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:39.510","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21177"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-38.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"GNW protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Bucle infinito del disector del protocolo GNW en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-6523","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T15:03:15.757283Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:39.510","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21177"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-38.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6527.json b/data/2026/CVE-2026-6527.json
index df9dabaac4..678fb2a5fe 100644
--- a/data/2026/CVE-2026-6527.json
+++ b/data/2026/CVE-2026-6527.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ASN.1 PER protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6527","lastModified":"2026-06-17T11:00:56.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T15:00:42.419100Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:39.890","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21149"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-34.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ASN.1 PER protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo ASN.1 PER en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-6527","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T15:00:42.419100Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:39.890","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21149"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-34.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6529.json b/data/2026/CVE-2026-6529.json
index b38db7c6cc..6fb36e5295 100644
--- a/data/2026/CVE-2026-6529.json
+++ b/data/2026/CVE-2026-6529.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"iLBC audio codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6529","lastModified":"2026-06-17T11:00:56.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:57:17.937339Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.130","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21145"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-32.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"iLBC audio codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del códec de audio iLBC en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-6529","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:57:17.937339Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.130","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21145"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-32.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6531.json b/data/2026/CVE-2026-6531.json
index 8699806100..39f71ed299 100644
--- a/data/2026/CVE-2026-6531.json
+++ b/data/2026/CVE-2026-6531.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6531","lastModified":"2026-06-17T11:00:56.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T13:04:44.146119Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.373","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21139"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-30.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21139"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"El disector del protocolo SANE con bucle infinito en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-6531","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T13:04:44.146119Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.373","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21139"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-30.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21139"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6532.json b/data/2026/CVE-2026-6532.json
index 0eee317036..961f77fcac 100644
--- a/data/2026/CVE-2026-6532.json
+++ b/data/2026/CVE-2026-6532.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kismet protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6532","lastModified":"2026-06-17T11:00:56.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6532","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:33:56.658175Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.500","references":[{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21128"},{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21129"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-29.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21129"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kismet protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo Kismet en Wireshark de 4.6.0 a 4.6.4 y de 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-6532","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6532","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:33:56.658175Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.500","references":[{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21128"},{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21129"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-29.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21129"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6534.json b/data/2026/CVE-2026-6534.json
index e0ba6a89c2..b53e646948 100644
--- a/data/2026/CVE-2026-6534.json
+++ b/data/2026/CVE-2026-6534.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"USB HID protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6534","lastModified":"2026-06-17T11:00:56.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6534","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:48:31.845877Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.753","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21121"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-27.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21121"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"USB HID protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Bucle infinito en el disector del protocolo USB HID en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-6534","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6534","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:48:31.845877Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.753","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21121"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-27.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21121"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6535.json b/data/2026/CVE-2026-6535.json
index c30edae511..4052a0aeaf 100644
--- a/data/2026/CVE-2026-6535.json
+++ b/data/2026/CVE-2026-6535.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dissection engine zlib decompression crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6535","lastModified":"2026-06-17T11:00:56.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:31:30.169396Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.870","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21097"},{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21098"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-26.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1325"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dissection engine zlib decompression crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo de descompresión zlib del motor de disección en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-6535","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:31:30.169396Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.870","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21097"},{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21098"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-26.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1325"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6536.json b/data/2026/CVE-2026-6536.json
index 23a3fb3323..98460fdebc 100644
--- a/data/2026/CVE-2026-6536.json
+++ b/data/2026/CVE-2026-6536.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"DLMS/COSEM protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4"}],"id":"CVE-2026-6536","lastModified":"2026-06-17T11:00:57.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6536","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:45:55.936992Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.987","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21065"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-25.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21065"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"DLMS/COSEM protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4"},{"lang":"es","value":"Bucle infinito del disector del protocolo DLMS/COSEM en Wireshark 4.6.0 a 4.6.4"}],"id":"CVE-2026-6536","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6536","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:45:55.936992Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:40.987","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21065"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-25.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21065"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6537.json b/data/2026/CVE-2026-6537.json
index 6528eec5d6..a86c95641e 100644
--- a/data/2026/CVE-2026-6537.json
+++ b/data/2026/CVE-2026-6537.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ZigBee protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6537","lastModified":"2026-06-17T11:00:57.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6537","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:49:29.009703Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:41.103","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21125"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-24.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21125"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ZigBee protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo ZigBee en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite la denegación de servicio"}],"id":"CVE-2026-6537","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6537","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:49:29.009703Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:41.103","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/issues/21125"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-24.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21125"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6539.json b/data/2026/CVE-2026-6539.json
index a86f0fe82e..c860719452 100644
--- a/data/2026/CVE-2026-6539.json
+++ b/data/2026/CVE-2026-6539.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Notepad++","vendor":"Notepad++","versions":[{"lessThan":"8.9.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:8.9.3:*:*:*:*:*:*:*","matchCriteriaId":"C8130B60-1945-4683-9267-16AE16685649","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents."}],"id":"CVE-2026-6539","lastModified":"2026-06-17T11:00:57.383","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:21:36.067358Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:33.820","references":[{"source":"disclosure@vulncheck.com","tags":["Release Notes"],"url":"https://notepad-plus-plus.org/news/v894-released/"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/notepad-format-string-injection-via-nativelang-xml"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Notepad++","vendor":"Notepad++","versions":[{"lessThan":"8.9.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:notepad-plus-plus:notepad\\+\\+:8.9.3:*:*:*:*:*:*:*","matchCriteriaId":"C8130B60-1945-4683-9267-16AE16685649","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious nativeLang.xml language pack file. Attackers can distribute a poisoned language pack through community channels that triggers format string interpretation when a user performs search operations, leading to access violations and potential leakage of stack or register contents."},{"lang":"es","value":"Notepad++ 8.9.3 contiene una vulnerabilidad de inyección de cadena de formato en el gestor del panel de resultados de búsqueda que permite a los atacantes causar denegación de servicio y revelación de información mediante la creación de un archivo de paquete de idioma nativeLang.xml malicioso. Los atacantes pueden distribuir un paquete de idioma envenenado a través de canales de la comunidad que activa la interpretación de la cadena de formato cuando un usuario realiza operaciones de búsqueda, lo que lleva a violaciones de acceso y a la posible fuga de contenidos de la pila o de los registros."}],"id":"CVE-2026-6539","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T14:21:36.067358Z","version":"2.0.3"}}]},"published":"2026-04-30T21:16:33.820","references":[{"source":"disclosure@vulncheck.com","tags":["Release Notes"],"url":"https://notepad-plus-plus.org/news/v894-released/"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/notepad-format-string-injection-via-nativelang-xml"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-65949.json b/data/2026/CVE-2026-65949.json
new file mode 100644
index 0000000000..9133eb0356
--- /dev/null
+++ b/data/2026/CVE-2026-65949.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"XClarity Integrator for WAC","vendor":"Lenovo","versions":[{"lessThanOrEqual":"5.2.0","status":"affected","version":"5.1.1","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows Admin Center 5.1.1 and 5.2.0 allows an authenticated remote attacker to execute arbitrary PowerShell commands by submitting a crafted hostname."}],"id":"CVE-2026-65949","lastModified":"2026-11-11T22:17:27.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T22:17:27.373","references":[{"source":"psirt@lenovo.com","url":"https://support.lenovo.com/us/en/solutions/ht507549-lenovo-xclarity-integrator-for-microsoft-windows-admin-center-v21"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-94"}],"source":"psirt@lenovo.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-65950.json b/data/2026/CVE-2026-65950.json
new file mode 100644
index 0000000000..5c082e7ed3
--- /dev/null
+++ b/data/2026/CVE-2026-65950.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"OneCLI","vendor":"Lenovo","versions":[{"lessThanOrEqual":"5.6.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted ZIP-based update package."}],"id":"CVE-2026-65950","lastModified":"2026-11-11T22:17:27.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":0.6,"impactScore":5.2,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T22:17:27.570","references":[{"source":"psirt@lenovo.com","url":"https://support.lenovo.com/us/en/solutions/ht116433"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"psirt@lenovo.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-65951.json b/data/2026/CVE-2026-65951.json
new file mode 100644
index 0000000000..3e25ea0238
--- /dev/null
+++ b/data/2026/CVE-2026-65951.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"OneCLI","vendor":"Lenovo","versions":[{"lessThanOrEqual":"5.6.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability in the TAR.GZ extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted TAR.GZ update package."}],"id":"CVE-2026-65951","lastModified":"2026-11-11T22:17:27.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":0.6,"impactScore":5.2,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T22:17:27.753","references":[{"source":"psirt@lenovo.com","url":"https://support.lenovo.com/us/en/solutions/ht116433"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Received"}
diff --git a/data/2026/CVE-2026-65952.json b/data/2026/CVE-2026-65952.json
new file mode 100644
index 0000000000..fe3e7f4c25
--- /dev/null
+++ b/data/2026/CVE-2026-65952.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Linux"],"product":"OneCLI","vendor":"Lenovo","versions":[{"lessThanOrEqual":"5.6.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an OS command in the remote SSH operation functionality of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to execute arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a specially crafted remote path."}],"id":"CVE-2026-65952","lastModified":"2026-11-11T22:17:27.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T22:17:27.917","references":[{"source":"psirt@lenovo.com","url":"https://support.lenovo.com/us/en/solutions/ht116433"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"psirt@lenovo.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-65957.json b/data/2026/CVE-2026-65957.json
new file mode 100644
index 0000000000..05bf853feb
--- /dev/null
+++ b/data/2026/CVE-2026-65957.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"helio","vendor":"gethelio","versions":[{"status":"affected","version":"< 0.8.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0."}],"id":"CVE-2026-65957","lastModified":"2026-11-11T21:16:46.243","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/commit/4ca8329c38b0edbc5e4d782a4e3b0cfc5cd7782e"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/pull/121"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/releases/tag/v0.8.0"},{"source":"security-advisories@github.com","url":"https://github.com/gethelio/helio/security/advisories/GHSA-2c3r-q7gv-hp2m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"},{"lang":"en","value":"CWE-942"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-65965.json b/data/2026/CVE-2026-65965.json
new file mode 100644
index 0000000000..f9c41d3450
--- /dev/null
+++ b/data/2026/CVE-2026-65965.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"ideon","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. The most severe is POST /api/projects/[id]/graph, which deletes every block and link in the project and re-inserts client-supplied ones. A viewer can silently rewrite or wipe the entire canvas of a project they were invited to read. The application clearly intends viewer to be read-only: the collaborators endpoint, the automation endpoints, and the realtime Yjs sync path all reject write attempts from viewers. These specific HTTP handlers simply omit the guard their siblings enforce. This issue has been patched in version 0.9.4."}],"id":"CVE-2026-65965","lastModified":"2026-11-11T21:16:46.410","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.410","references":[{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/commit/ed58ca7a70543c7fc4ebfef59a2ca34e480e44d1"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-v3qr-4v8m-29rh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-65968.json b/data/2026/CVE-2026-65968.json
new file mode 100644
index 0000000000..7788970cb9
--- /dev/null
+++ b/data/2026/CVE-2026-65968.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"ideon","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/regex matching on new URL(url).hostname. Their IPv6 branch only recognises the textual forms ::1, fe80:/fc00:/fd00: prefixes, and the dotted-decimal IPv4-mapped form ::ffff:127.x. It does not recognise the WHATWG-canonical IPv4-mapped-IPv6 host that Node emits for a mapped address, which is hex-compressed and bracket-wrapped: [::ffff:7f00:1] for 127.0.0.1, [::ffff:a9fe:a9fe] for 169.254.169.254. An authenticated user who registers a STREAMABLE_HTTP / SSE MCP server with URL http://[::ffff:7f00:1]:PORT/ (loopback) or http://[::ffff:a9fe:a9fe]/ (cloud metadata) passes both guards, and the server-side OAuth-discovery action then fetches that host, yielding server-side request forgery to loopback and to the cloud metadata service. This issue has been patched in version 0.9.4."}],"id":"CVE-2026-65968","lastModified":"2026-11-11T21:16:46.563","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.563","references":[{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/commit/58e2f26bb7259d24c963a753962ac34f56c63b01"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-cvcr-fcf6-366r"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-65971.json b/data/2026/CVE-2026-65971.json
new file mode 100644
index 0000000000..18b6261f08
--- /dev/null
+++ b/data/2026/CVE-2026-65971.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"livewire-powergrid","vendor":"Power-Components","versions":[{"status":"affected","version":">= 6.0.0, < 6.10.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4."}],"id":"CVE-2026-65971","lastModified":"2026-11-11T22:17:28.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:28.090","references":[{"source":"security-advisories@github.com","url":"https://github.com/Power-Components/livewire-powergrid/commit/13d047bf1637e82926e6914aa3ca0f29a4c9704a"},{"source":"security-advisories@github.com","url":"https://github.com/Power-Components/livewire-powergrid/releases/tag/v6.10.4"},{"source":"security-advisories@github.com","url":"https://github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698r"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-65973.json b/data/2026/CVE-2026-65973.json
new file mode 100644
index 0000000000..fab18a82c9
--- /dev/null
+++ b/data/2026/CVE-2026-65973.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"laradocs","vendor":"PeteBishwhip","versions":[{"status":"affected","version":">= 0.4.0, < 1.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Laradocs maintains version-controlled documentation inside a Laravel codebase. From version 0.4.0 to before version 1.0.0, Laradocs is vulnerable to local command injection in server-side KaTeX rendering via an unescaped Node.js binary path in a proc_open() command string. This issue has been patched in version 1.0.0."}],"id":"CVE-2026-65973","lastModified":"2026-11-11T21:16:46.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.720","references":[{"source":"security-advisories@github.com","url":"https://github.com/PeteBishwhip/laradocs/releases/tag/v1.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/PeteBishwhip/laradocs/security/advisories/GHSA-h746-qpxh-ph7g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-65982.json b/data/2026/CVE-2026-65982.json
new file mode 100644
index 0000000000..230ff4b6bb
--- /dev/null
+++ b/data/2026/CVE-2026-65982.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"nginx-http-flv-module","vendor":"winshining","versions":[{"status":"affected","version":"< 1.2.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-module used r->headers_in.host->value to make a pseudo tcUrl, so NULL-pointer dereference happened. This issue has been patched in version 1.2.14."}],"id":"CVE-2026-65982","lastModified":"2026-11-11T21:16:46.903","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.903","references":[{"source":"security-advisories@github.com","url":"https://github.com/winshining/nginx-http-flv-module/security/advisories/GHSA-8mc6-jrxv-29g9"},{"source":"security-advisories@github.com","url":"https://www.chtsecurity.com/news/b15d7b24-0a5e-4962-8b52-e4754e5af4f8?lang=en"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67449.json b/data/2026/CVE-2026-67449.json
new file mode 100644
index 0000000000..ea3cef2c3b
--- /dev/null
+++ b/data/2026/CVE-2026-67449.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"portabase","vendor":"Portabase","versions":[{"status":"affected","version":"< 1.21.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/master_key.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2."}],"id":"CVE-2026-67449","lastModified":"2026-11-11T22:17:28.257","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:28.257","references":[{"source":"security-advisories@github.com","url":"https://github.com/Portabase/portabase/commit/8dcb406790728fbdbf758ec88bf000af79498fc1"},{"source":"security-advisories@github.com","url":"https://github.com/Portabase/portabase/pull/355"},{"source":"security-advisories@github.com","url":"https://github.com/Portabase/portabase/releases/tag/1.21.2"},{"source":"security-advisories@github.com","url":"https://github.com/Portabase/portabase/security/advisories/GHSA-7697-vf3j-253j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67540.json b/data/2026/CVE-2026-67540.json
new file mode 100644
index 0000000000..6c91c2643d
--- /dev/null
+++ b/data/2026/CVE-2026-67540.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"heym","vendor":"heymrun","versions":[{"status":"affected","version":"< 0.0.70"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, get_workflow_template / get_node_template fetches a template by ID with no visibility / author / shared_with predicate, so any authenticated user can read (and use) any other tenant's private (visibility=specific_users) template — including its full node/edge graph and the email addresses it was shared with. The list endpoint enforces visibility correctly; the single-item get/use paths do not. This issue has been patched in version 0.0.70."}],"id":"CVE-2026-67540","lastModified":"2026-11-11T22:17:28.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:28.433","references":[{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/4bcea469bfeee8c2659de90a1b2d16fdfed9ae97"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/releases/tag/0.0.70"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/security/advisories/GHSA-5748-x76g-v68m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67541.json b/data/2026/CVE-2026-67541.json
new file mode 100644
index 0000000000..d657ead895
--- /dev/null
+++ b/data/2026/CVE-2026-67541.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"heym","vendor":"heymrun","versions":[{"status":"affected","version":"< 0.0.70"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.user_id, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70."}],"id":"CVE-2026-67541","lastModified":"2026-11-11T22:17:28.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:28.620","references":[{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/863e2702fca9a584246da9a51cca6b12828cebcf"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/a9fc3d864e87fa2449b235798189db9cd39367c4"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/def26b5cf77dad4a9c5b5ff11c9863a0bc144ac8"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/releases/tag/0.0.70"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/security/advisories/GHSA-vxpw-x7j7-8723"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67542.json b/data/2026/CVE-2026-67542.json
new file mode 100644
index 0000000000..7e7cb85d6a
--- /dev/null
+++ b/data/2026/CVE-2026-67542.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"heym","vendor":"heymrun","versions":[{"status":"affected","version":"< 0.0.70"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, POST /api/mcp/fetch-tools is reachable by any authenticated user (lowest role; no admin/workflow association) and fetches an attacker-supplied URL through the sse and streamable_http transports with no scheme / private-IP / allowlist / redirect guard. The transport error is reflected in the HTTP 422 response, giving a semi-blind SSRF oracle, and the attacker also controls the outbound request headers. This issue has been patched in version 0.0.70."}],"id":"CVE-2026-67542","lastModified":"2026-11-11T22:17:28.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:28.813","references":[{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/72954f1f6264f6260bc1148b09ca10d613992b64"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/releases/tag/0.0.70"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/security/advisories/GHSA-jjvx-3wfc-p8hq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67543.json b/data/2026/CVE-2026-67543.json
new file mode 100644
index 0000000000..7aed1e22fb
--- /dev/null
+++ b/data/2026/CVE-2026-67543.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"heym","vendor":"heymrun","versions":[{"status":"affected","version":"< 0.0.70"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, heym hardens one untrusted-code path but not its sibling. The Python tool executor (python_tool_executor.py) treats user code as untrusted and mandates a Docker sandbox (no network, read-only fs, non-root, no docker socket), failing closed. The skill executor (skill_python_executor.py) runs skill Python via a local backend subprocess with no Docker isolation — only a 512 MB RLIMIT and a 7-key env denylist — so a skill executes inside the backend execution context, with filesystem access, network egress, and non-denylisted environment variables that should not be exposed to untrusted/shared skills. In the shipped Docker config (backend runs as root + /var/run/docker.sock mounted), this escalates to host root. This issue has been patched in version 0.0.70."}],"id":"CVE-2026-67543","lastModified":"2026-11-11T22:17:29.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:28.997","references":[{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/2155057f4153a1e3a7b789d104f7fa96e92964e5"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/28bb2901e4dea128ac493f67ee9478d230b7a3d7"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/releases/tag/0.0.70"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/security/advisories/GHSA-hcv7-mg77-pg73"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-269"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67544.json b/data/2026/CVE-2026-67544.json
new file mode 100644
index 0000000000..2273388356
--- /dev/null
+++ b/data/2026/CVE-2026-67544.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"heym","vendor":"heymrun","versions":[{"status":"affected","version":"< 0.0.71"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This string is written to a temporary .py file and executed directly by the backend process via subprocess.Popen([sys.executable, script_path]) with no sandboxing, AST validation, or role gate. Any authenticated user — including a freshly registered account — can achieve full remote code execution (RCE) on the backend host, running as the service process user (observed as root in the default Docker deployment). This issue has been patched in version 0.0.71."}],"id":"CVE-2026-67544","lastModified":"2026-11-11T22:17:29.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:29.180","references":[{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/d2fd46c07754c4ed3e80b521aa54cc276039849b"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/releases/tag/0.0.71"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/security/advisories/GHSA-mp23-7m6r-jfw4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67545.json b/data/2026/CVE-2026-67545.json
new file mode 100644
index 0000000000..b6c806a230
--- /dev/null
+++ b/data/2026/CVE-2026-67545.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"heym","vendor":"heymrun","versions":[{"status":"affected","version":"< 0.0.73"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.73, the HTTP workflow node in Heym makes outbound HTTP requests to user-supplied URLs without validation of the target host or IP address. If a workflow author has already configured an HTTP node that targets internal addresses such as cloud metadata endpoints or private network hosts, and exposed the workflow with anonymous execution, an unauthenticated attacker can trigger the preconfigured SSRF sink. The same project has comprehensive SSRF protection in its MCP integration, which is absent from the HTTP node. This issue has been patched in version 0.0.73."}],"id":"CVE-2026-67545","lastModified":"2026-11-11T22:17:29.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:29.360","references":[{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/360a8de56ab9be0b11acdfe89168c5f2d7ab6b1e"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/583311603f8f81bf2f45a842727046ef17c99c9e"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/87c216f6e564c58d1dd747115d079fb487233ccf"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/releases/tag/0.0.73"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/security/advisories/GHSA-8wj7-v2w6-wfcx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67546.json b/data/2026/CVE-2026-67546.json
new file mode 100644
index 0000000000..4d8c23d614
--- /dev/null
+++ b/data/2026/CVE-2026-67546.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"heym","vendor":"heymrun","versions":[{"status":"affected","version":"< 0.0.75"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same POST /api/mcp/fetch-tools endpoint (any authenticated user, lowest role) also accepts the stdio transport, which spawns the attacker-supplied command with attacker-supplied args and an environment merged over os.environ. The process executes on the shared backend host before MCP protocol validation fails — so side effects fire regardless of whether the command speaks MCP. This is a distinct weakness class and exploit primitive from the SSRF (Advisory 2) on the same endpoint, and needs a different fix (role gating / opt-in trust boundary rather than egress controls). This issue has been patched in version 0.0.75."}],"id":"CVE-2026-67546","lastModified":"2026-11-11T22:17:29.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:29.533","references":[{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/22b8ee60eb92128cf4ff04a9b6c0e1b62bf25a01"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/commit/6c6213f88dfa8b2a70d23a9a271171241e910904"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/releases/tag/v0.0.75"},{"source":"security-advisories@github.com","url":"https://github.com/heymrun/heym/security/advisories/GHSA-378x-q589-34mv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67547.json b/data/2026/CVE-2026-67547.json
new file mode 100644
index 0000000000..53e948bd56
--- /dev/null
+++ b/data/2026/CVE-2026-67547.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"taOS","vendor":"jaylfc","versions":[{"status":"affected","version":"< 1.0.0-beta.23"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run([\"python3\", \"-c\", code]) — without performing any admin role check, skill ownership check, or agent assignment verification. Any authenticated non-admin user can supply attacker-controlled Python code in the request body and have it executed as the taOS backend process user on the host, achieving full remote code execution with no privilege escalation required beyond a valid (non-admin) session. This issue has been patched in version 1.0.0-beta.23."}],"id":"CVE-2026-67547","lastModified":"2026-11-11T22:17:29.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:29.710","references":[{"source":"security-advisories@github.com","url":"https://github.com/jaylfc/taOS/commit/8998d85190424d5e843880b4ca256e79b653a304"},{"source":"security-advisories@github.com","url":"https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.23"},{"source":"security-advisories@github.com","url":"https://github.com/jaylfc/taOS/security/advisories/GHSA-h24f-gp4c-8qjm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-67548.json b/data/2026/CVE-2026-67548.json
new file mode 100644
index 0000000000..b03d0b8a22
--- /dev/null
+++ b/data/2026/CVE-2026-67548.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"taOS","vendor":"jaylfc","versions":[{"status":"affected","version":"< 1.0.0-beta.25"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose is_admin flag is explicitly False—can read the full system configuration, overwrite it, modify platform settings, trigger a git pull + dependency reinstall + service restart, and switch the tracked update branch. Successful exploitation of the write endpoints causes immediate configuration corruption or a denial of service for all users on the instance from a low-privileged account. This issue has been patched in version 1.0.0-beta.25."}],"id":"CVE-2026-67548","lastModified":"2026-11-11T22:17:29.863","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:29.863","references":[{"source":"security-advisories@github.com","url":"https://github.com/jaylfc/taOS/commit/6e65dd7ddd4b973e326d7ccb0ec74e8eef65374b"},{"source":"security-advisories@github.com","url":"https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.25"},{"source":"security-advisories@github.com","url":"https://github.com/jaylfc/taOS/security/advisories/GHSA-47g9-fwwp-hrfp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-68507.json b/data/2026/CVE-2026-68507.json
new file mode 100644
index 0000000000..0799d66463
--- /dev/null
+++ b/data/2026/CVE-2026-68507.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"ideon","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.5"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetch/validateSafeUrl in src/app/lib/ssrf.ts), but this route sits behind no login check whatsoever, making it a fully open, anonymous URL-fetch relay - and the guard's IP blocklist itself has a gap that lets it reach the server's own loopback interface via the 0.0.0.0 \"any address\" bypass, a well-documented SSRF-filter evasion technique on Linux. This issue has been patched in version 0.9.5."}],"id":"CVE-2026-68507","lastModified":"2026-11-11T21:16:47.057","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:47.057","references":[{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.5"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-vpc2-r395-534p"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-68511.json b/data/2026/CVE-2026-68511.json
new file mode 100644
index 0000000000..8ab34090cd
--- /dev/null
+++ b/data/2026/CVE-2026-68511.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"paaster","vendor":"WardPearce","versions":[{"status":"affected","version":"< 3.3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Paaster is a pastebin application. Prior to version 3.3.0, Paaster's \"view once\" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as \"not yet read\" and all successfully retrieve it. This issue has been patched in version 3.3.0."}],"id":"CVE-2026-68511","lastModified":"2026-11-11T22:17:30.013","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:30.013","references":[{"source":"security-advisories@github.com","url":"https://github.com/WardPearce/paaster/releases/tag/v3.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-68512.json b/data/2026/CVE-2026-68512.json
new file mode 100644
index 0000000000..4a8785b33b
--- /dev/null
+++ b/data/2026/CVE-2026-68512.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"paaster","vendor":"WardPearce","versions":[{"status":"affected","version":"< 3.3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0."}],"id":"CVE-2026-68512","lastModified":"2026-11-11T22:17:30.163","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:30.163","references":[{"source":"security-advisories@github.com","url":"https://github.com/WardPearce/paaster/releases/tag/v3.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/WardPearce/paaster/security/advisories/GHSA-9q9w-qhhm-2xwg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-204"},{"lang":"en","value":"CWE-307"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-68538.json b/data/2026/CVE-2026-68538.json
new file mode 100644
index 0000000000..d76b18f087
--- /dev/null
+++ b/data/2026/CVE-2026-68538.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"fulgur","vendor":"fulgur-rs","versions":[{"status":"affected","version":">= 0.15.0, < 0.27.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither in the size of a single expansion nor in the aggregate work across an element tree. An attacker able to submit HTML/CSS to a fulgur-based conversion service can trigger CPU and memory exhaustion with a trivially small payload, denying service to the host and any co-tenants. This issue has been patched in version 0.27.0."}],"id":"CVE-2026-68538","lastModified":"2026-11-11T22:17:30.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:30.313","references":[{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/commit/ebc75691ad368f1c1a211543313b04da2af466d6"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.27.0"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-395p-pj7r-jm42"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-68539.json b/data/2026/CVE-2026-68539.json
new file mode 100644
index 0000000000..d020d90c16
--- /dev/null
+++ b/data/2026/CVE-2026-68539.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"fulgur","vendor":"fulgur-rs","versions":[{"status":"affected","version":">= 0.4.4, < 0.29.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per element with no memory budget, letting a small crafted document amplify into large retained memory (and the CPU to copy it) — results in a denial of service. This issue has been patched in version 0.29.0."}],"id":"CVE-2026-68539","lastModified":"2026-11-11T22:17:30.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:30.480","references":[{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/commit/1c4cdad003daef7c9dc6ef1362c50bcfaac13ea9"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/commit/9248fbfd91a2ba8fc3dbd9e44ba681f52ed1ecd0"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/pull/582"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/pull/584"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.29.0"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-vw2v-g4x7-xcqg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-68540.json b/data/2026/CVE-2026-68540.json
new file mode 100644
index 0000000000..786092172d
--- /dev/null
+++ b/data/2026/CVE-2026-68540.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"fulgur","vendor":"fulgur-rs","versions":[{"status":"affected","version":">= 0.6.0, < 0.33.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements cause denial of service. This issue has been patched in version 0.33.0."}],"id":"CVE-2026-68540","lastModified":"2026-11-11T22:17:30.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T22:17:30.677","references":[{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/commit/8fabbca271313c56ef48f1d20d0040e1cf130de5"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/pull/602"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/releases/tag/v0.33.0"},{"source":"security-advisories@github.com","url":"https://github.com/fulgur-rs/fulgur/security/advisories/GHSA-v8x5-rchq-jr47"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-405"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-6867.json b/data/2026/CVE-2026-6867.json
index ac93752cdf..bbfccb8c61 100644
--- a/data/2026/CVE-2026-6867.json
+++ b/data/2026/CVE-2026-6867.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SMB2 protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6867","lastModified":"2026-06-17T11:01:27.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:53:22.927117Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:41.350","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21191"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-45.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1325"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SMB2 protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo SMB2 en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-6867","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:53:22.927117Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:41.350","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21191"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-45.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1325"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6868.json b/data/2026/CVE-2026-6868.json
index 553f0f6f10..d1a36ab9c1 100644
--- a/data/2026/CVE-2026-6868.json
+++ b/data/2026/CVE-2026-6868.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"HTTP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6868","lastModified":"2026-06-17T11:01:27.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:53:03.923868Z","version":"2.0.3"}}]},"published":"2026-04-30T06:16:16.783","references":[{"source":"cve@gitlab.com","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21185"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-46.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"HTTP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo HTTP en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-6868","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6868","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:53:03.923868Z","version":"2.0.3"}}]},"published":"2026-04-30T06:16:16.783","references":[{"source":"cve@gitlab.com","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21185"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-46.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-6869.json b/data/2026/CVE-2026-6869.json
index 7acf9c99f9..0f7fc58155 100644
--- a/data/2026/CVE-2026-6869.json
+++ b/data/2026/CVE-2026-6869.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"WebSocket protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-6869","lastModified":"2026-06-17T11:01:27.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6869","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:46:45.361455Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:41.470","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21190"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-44.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21190"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1325"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"77CF79F1-B53C-40A7-9570-A192D5A85ED6","versionEndIncluding":"4.4.14","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"B52139AE-161F-406A-B28D-F874CE8B68B6","versionEndIncluding":"4.6.4","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"WebSocket protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo del disector del protocolo WebSocket en Wireshark 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-6869","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-6869","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T12:46:45.361455Z","version":"2.0.3"}}]},"published":"2026-04-30T07:16:41.470","references":[{"source":"cve@gitlab.com","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21190"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-44.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21190"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1325"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-7164.json b/data/2026/CVE-2026-7164.json
index b6237da0b1..71b276b2cb 100644
--- a/data/2026/CVE-2026-7164.json
+++ b/data/2026/CVE-2026-7164.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["pf"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters.  This can eventually result in a stack overflow and panic.\n\nRemote attackers can craft packets which cause affected systems to panic.  This affects any system where pf is configured to process traffic, independent of the configured ruleset."}],"id":"CVE-2026-7164","lastModified":"2026-06-17T11:01:57.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7164","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T13:08:52.241699Z","version":"2.0.3"}}]},"published":"2026-04-30T08:16:07.653","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:14.pf.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-791"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["pf"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters.  This can eventually result in a stack overflow and panic.\n\nRemote attackers can craft packets which cause affected systems to panic.  This affects any system where pf is configured to process traffic, independent of the configured ruleset."},{"lang":"es","value":"La validación de paquetes incorrecta permitió una recursión ilimitada al analizar los parámetros de fragmentos SCTP. Esto puede eventualmente resultar en un desbordamiento de pila y un pánico.\n\nAtacantes remotos pueden crear paquetes que causen que los sistemas afectados entren en pánico. Esto afecta a cualquier sistema donde pf esté configurado para procesar tráfico, independientemente del conjunto de reglas configurado."}],"id":"CVE-2026-7164","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7164","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T13:08:52.241699Z","version":"2.0.3"}}]},"published":"2026-04-30T08:16:07.653","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:14.pf.asc"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-791"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-7270.json b/data/2026/CVE-2026-7270.json
index c4bb4b961d..67ff678414 100644
--- a/data/2026/CVE-2026-7270.json
+++ b/data/2026/CVE-2026-7270.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["kernel"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers.\n\nThe bug may be exploitable by an unprivileged user to obtain superuser privileges."}],"id":"CVE-2026-7270","lastModified":"2026-06-17T11:02:07.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-30T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-30T07:16:41.710","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:13.exec.asc"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://blog.calif.io/p/cve-2026-7270-how-i-get-root-on-freebsd"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://news.ycombinator.com/item?id=48077971"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-783"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","modules":["kernel"],"product":"FreeBSD","vendor":"FreeBSD","versions":[{"lessThan":"p7","status":"affected","version":"15.0-RELEASE","versionType":"release"},{"lessThan":"p3","status":"affected","version":"14.4-RELEASE","versionType":"release"},{"lessThan":"p12","status":"affected","version":"14.3-RELEASE","versionType":"release"},{"lessThan":"p13","status":"affected","version":"13.5-RELEASE","versionType":"release"}]}],"source":"secteam@freebsd.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:-:*:*:*:*:*:*","matchCriteriaId":"947F561E-AD65-43B9-94C1-3109A3D35248","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:beta3:*:*:*:*:*:*","matchCriteriaId":"4216D505-95A5-4FCC-8B9A-26FCD32B0445","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p1:*:*:*:*:*:*","matchCriteriaId":"3D1987F1-1E08-4B28-8D16-D25A091D99ED","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p10:*:*:*:*:*:*","matchCriteriaId":"4C859EE2-59C0-4234-BFF0-7794AC4956DD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p11:*:*:*:*:*:*","matchCriteriaId":"D1CEB391-5FA3-4FFD-9279-113093DD500D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p12:*:*:*:*:*:*","matchCriteriaId":"EE54A637-BD2A-42F2-A155-CF3D4292B32D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p2:*:*:*:*:*:*","matchCriteriaId":"BEC1E8A0-0402-45F1-938D-FEFDCFC3E747","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p3:*:*:*:*:*:*","matchCriteriaId":"D94457D6-738F-4ABB-BD46-F2B621531FE2","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p4:*:*:*:*:*:*","matchCriteriaId":"8C38CB56-B80C-4D1B-9267-16E8F985B170","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p5:*:*:*:*:*:*","matchCriteriaId":"13DF1E38-5E8D-42FF-A4C5-092300864F3E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p6:*:*:*:*:*:*","matchCriteriaId":"83A86F81-0965-4600-835A-496756137998","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p7:*:*:*:*:*:*","matchCriteriaId":"987E31A4-7E21-471E-A3EA-4E53FFDB3DFB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p8:*:*:*:*:*:*","matchCriteriaId":"9FBFE8B3-DC7C-4394-B062-C40E201EC059","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:13.5:p9:*:*:*:*:*:*","matchCriteriaId":"563C1D65-625D-43FC-A7A0-75B1E2163C40","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:-:*:*:*:*:*:*","matchCriteriaId":"9DC7C54E-58AF-4ADE-84AF-0EF0F325E20E","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p1:*:*:*:*:*:*","matchCriteriaId":"D3D22B8C-36CF-4800-9673-0B0240558BDD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p10:*:*:*:*:*:*","matchCriteriaId":"7296F5AA-F8C1-4277-A4EE-C2B24073A320","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p11:*:*:*:*:*:*","matchCriteriaId":"C30E4A9C-0594-4F40-92B3-26CB9AA85AE9","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p2:*:*:*:*:*:*","matchCriteriaId":"242FA2A8-5D7D-4617-A411-2651FF3A3E4C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p3:*:*:*:*:*:*","matchCriteriaId":"40573F60-F3B7-4AEC-846A-B08E5B7D9D00","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p4:*:*:*:*:*:*","matchCriteriaId":"1FB832CE-0A98-44A2-8BAC-CD38A64279B6","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p5:*:*:*:*:*:*","matchCriteriaId":"9A785F8E-C218-41AE-8D57-BF06DDAEF7CB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p6:*:*:*:*:*:*","matchCriteriaId":"C3909FDD-B2A2-45B6-A40B-1D303A717F15","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p7:*:*:*:*:*:*","matchCriteriaId":"720597A2-F181-46E1-8A0D-097E17ADC4FB","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p8:*:*:*:*:*:*","matchCriteriaId":"DC8A75D0-148A-427A-9783-45477EABED21","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.3:p9:*:*:*:*:*:*","matchCriteriaId":"F5D39FC9-6DBA-46C8-BB80-A6188E6A8527","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:-:*:*:*:*:*:*","matchCriteriaId":"8F3856BE-666F-4FA1-A6AD-FE179CEBF1E4","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p1:*:*:*:*:*:*","matchCriteriaId":"D9CC0037-3282-42C3-80D8-F6C1D43B9332","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:p2:*:*:*:*:*:*","matchCriteriaId":"1EADA828-3C20-43C0-A0CA-3AC7D7F23DBD","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:14.4:rc1:*:*:*:*:*:*","matchCriteriaId":"0342A715-E211-4AF6-97ED-32EB9EBB947D","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:-:*:*:*:*:*:*","matchCriteriaId":"368CFE5D-C5C2-42AF-AAF4-28DFE1A59C3B","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p1:*:*:*:*:*:*","matchCriteriaId":"AA4AAA57-70A7-4717-ACF2-A253E757FF2C","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p2:*:*:*:*:*:*","matchCriteriaId":"E24ABFA6-4D12-4DE5-832B-438502C7D188","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p3:*:*:*:*:*:*","matchCriteriaId":"C1C9869C-494B-4628-9AA3-4AA5B989C377","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p4:*:*:*:*:*:*","matchCriteriaId":"002AA2FE-C7BA-471A-9434-0E56A878ACBF","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p5:*:*:*:*:*:*","matchCriteriaId":"B187670D-E3A2-4A0D-A653-982F8B447E78","vulnerable":true},{"criteria":"cpe:2.3:o:freebsd:freebsd:15.0:p6:*:*:*:*:*:*","matchCriteriaId":"047E7EE9-FB51-4CF2-A8BE-484BFD819565","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers.\n\nThe bug may be exploitable by an unprivileged user to obtain superuser privileges."},{"lang":"es","value":"Un error de precedencia de operadores en el kernel resulta en un escenario donde un desbordamiento de búfer causa que datos controlados por el atacante sobrescriban búferes de argumentos de execve(2) adyacentes.\n\nEl error puede ser explotable por un usuario sin privilegios para obtener privilegios de superusuario."}],"id":"CVE-2026-7270","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-30T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-30T07:16:41.710","references":[{"source":"secteam@freebsd.org","tags":["Vendor Advisory"],"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:13.exec.asc"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://blog.calif.io/p/cve-2026-7270-how-i-get-root-on-freebsd"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://news.ycombinator.com/item?id=48077971"}],"sourceIdentifier":"secteam@freebsd.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-783"}],"source":"secteam@freebsd.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-7376.json b/data/2026/CVE-2026-7376.json
index 812840d36a..24d60a37a5 100644
--- a/data/2026/CVE-2026-7376.json
+++ b/data/2026/CVE-2026-7376.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-7376","lastModified":"2026-06-17T11:02:18.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7376","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T16:07:35.110973Z","version":"2.0.3"}}]},"published":"2026-04-30T06:16:17.053","references":[{"source":"cve@gitlab.com","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21206"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-48.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21206"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo en sharkd 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-7376","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7376","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T16:07:35.110973Z","version":"2.0.3"}}]},"published":"2026-04-30T06:16:17.053","references":[{"source":"cve@gitlab.com","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21206"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-48.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21206"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-7378.json b/data/2026/CVE-2026-7378.json
index 88fc2df67c..5e978de209 100644
--- a/data/2026/CVE-2026-7378.json
+++ b/data/2026/CVE-2026-7378.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-7378","lastModified":"2026-06-17T11:02:18.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:48:03.008532Z","version":"2.0.3"}}]},"published":"2026-04-30T06:16:17.183","references":[{"source":"cve@gitlab.com","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21207"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-49.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fallo en sharkd 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-7378","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:48:03.008532Z","version":"2.0.3"}}]},"published":"2026-04-30T06:16:17.183","references":[{"source":"cve@gitlab.com","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21207"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-49.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-7379.json b/data/2026/CVE-2026-7379.json
index a6a2de2a35..299c0de156 100644
--- a/data/2026/CVE-2026-7379.json
+++ b/data/2026/CVE-2026-7379.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"}],"id":"CVE-2026-7379","lastModified":"2026-06-17T11:02:19.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:47:42.879306Z","version":"2.0.3"}}]},"published":"2026-04-30T06:16:17.333","references":[{"source":"cve@gitlab.com","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21214"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-47.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"cve@gitlab.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Wireshark","vendor":"Wireshark Foundation","versions":[{"lessThan":"4.6.5","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"4.4.15","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"8EAFFA8A-B5D8-4784-851E-E1B682871495","versionEndExcluding":"4.4.15","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*","matchCriteriaId":"1D804272-AD4D-4454-9629-1BBAA825D7C4","versionEndExcluding":"4.6.5","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service"},{"lang":"es","value":"Fuga de memoria en sharkd 4.6.0 a 4.6.4 y 4.4.0 a 4.4.14 permite denegación de servicio"}],"id":"CVE-2026-7379","lastModified":"2026-11-11T21:10:00.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-7379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T14:47:42.879306Z","version":"2.0.3"}}]},"published":"2026-04-30T06:16:17.333","references":[{"source":"cve@gitlab.com","tags":["Exploit","Vendor Advisory"],"url":"https://gitlab.com/wireshark/wireshark/-/work_items/21214"},{"source":"cve@gitlab.com","tags":["Vendor Advisory"],"url":"https://www.wireshark.org/security/wnpa-sec-2026-47.html"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"cve@gitlab.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-81936.json b/data/2026/CVE-2026-81936.json
new file mode 100644
index 0000000000..a59eea9865
--- /dev/null
+++ b/data/2026/CVE-2026-81936.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","ARM"],"product":"XClarity Controller","vendor":"Lenovo","versions":[{"lessThanOrEqual":"IHX436K","status":"affected","version":"IHX432Y","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation.  An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression."}],"id":"CVE-2026-81936","lastModified":"2026-11-11T22:17:30.877","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T22:17:30.877","references":[{"source":"psirt@lenovo.com","url":"https://lenovopress.lenovo.com/lp2273-lenovo-xclarity-controller-3-xcc3"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"psirt@lenovo.com","type":"Secondary"}]}
diff --git a/state/sync.json b/state/sync.json
index a9f2a2c23d..074c1c19f3 100644
--- a/state/sync.json
+++ b/state/sync.json
@@ -1 +1 @@
-{"initial_complete":true,"last_run_counts":{"seen":6328,"skipped":0,"unchanged":5473,"written":855},"last_run_mode":"incremental","last_successful_end":"2026-11-11T20:42:57+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-11T20:48:21.543179+00:00"}
+{"initial_complete":true,"last_run_counts":{"seen":6459,"skipped":0,"unchanged":6005,"written":454},"last_run_mode":"incremental","last_successful_end":"2026-11-11T22:42:31+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-11T22:48:22.027975+00:00"}