diff --git a/data/2025/CVE-2025-13327.json b/data/2025/CVE-2025-13327.json
index ddd6726cd0..03839b239c 100644
--- a/data/2025/CVE-2025-13327.json
+++ b/data/2025/CVE-2025-13327.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/astral-sh/uv","defaultStatus":"unaffected","packageName":"uv","product":"uv","vendor":"astral-sh","versions":[{"lessThan":"0.9.6","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042072","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042067","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793329709","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793328358","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"unaffected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaiis-preview/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch28-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-vllm-cpu-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:astral:uv:*:*:*:*:*:python:*:*","matchCriteriaId":"99A1D4A1-3DC2-4119-8A49-D31CF9FF72BD","versionEndExcluding":"0.9.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package."},{"lang":"es","value":"Se encontró una falla en uv. Esta vulnerabilidad permite a un atacante ejecutar código malicioso durante la resolución o instalación de paquetes a través de archivos ZIP (Paquete de Información Comprimida) especialmente manipulados que explotan diferenciales de análisis, requiriendo interacción del usuario para instalar un paquete controlado por el atacante."}],"id":"CVE-2025-13327","lastModified":"2026-11-04T06:16:56.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.3,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.3,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-13327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-03T19:46:14.125896Z","version":"2.0.3"}}]},"published":"2026-02-27T08:17:04.043","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91219"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91236"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94476"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2025-13327"},{"source":"secalert@redhat.com","tags":["Issue Tracking"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407263"},{"source":"secalert@redhat.com","tags":["Product"],"url":"https://github.com/astral-sh/uv"},{"source":"secalert@redhat.com","tags":["Patch"],"url":"https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-1286"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/astral-sh/uv","defaultStatus":"unaffected","packageName":"uv","product":"uv","vendor":"astral-sh","versions":[{"lessThan":"0.9.6","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793961846","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793962303","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793961309","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042072","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042067","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793329709","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793328358","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"unaffected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaiis-preview/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch28-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-vllm-cpu-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:astral:uv:*:*:*:*:*:python:*:*","matchCriteriaId":"99A1D4A1-3DC2-4119-8A49-D31CF9FF72BD","versionEndExcluding":"0.9.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package."},{"lang":"es","value":"Se encontró una falla en uv. Esta vulnerabilidad permite a un atacante ejecutar código malicioso durante la resolución o instalación de paquetes a través de archivos ZIP (Paquete de Información Comprimida) especialmente manipulados que explotan diferenciales de análisis, requiriendo interacción del usuario para instalar un paquete controlado por el atacante."}],"id":"CVE-2025-13327","lastModified":"2026-11-13T13:17:37.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.3,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.3,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-13327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-03T19:46:14.125896Z","version":"2.0.3"}}]},"published":"2026-02-27T08:17:04.043","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91219"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91236"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94476"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96400"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96403"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96406"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2025-13327"},{"source":"secalert@redhat.com","tags":["Issue Tracking"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2407263"},{"source":"secalert@redhat.com","tags":["Product"],"url":"https://github.com/astral-sh/uv"},{"source":"secalert@redhat.com","tags":["Patch"],"url":"https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-1286"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]}
diff --git a/data/2025/CVE-2025-41725.json b/data/2025/CVE-2025-41725.json
new file mode 100644
index 0000000000..5d16f66a09
--- /dev/null
+++ b/data/2025/CVE-2025-41725.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Flip 4","vendor":"Harman International","versions":[{"lessThan":"4.1.0","status":"affected","version":"0.0.0","versionType":"semver"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker."}],"id":"CVE-2025-41725","lastModified":"2026-11-13T13:17:38.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}]},"published":"2026-11-13T13:17:38.957","references":[{"source":"info@cert.vde.com","url":"https://certvde.com/en/advisories/VDE-2025-090/"},{"source":"info@cert.vde.com","url":"https://harman.csaf-tp.certvde.com/.well-known/csaf/white/2026/hbsa-2025-0003.json"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-923"}],"source":"info@cert.vde.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-0175.json b/data/2026/CVE-2026-0175.json
index 5572a000f3..0757ced753 100644
--- a/data/2026/CVE-2026-0175.json
+++ b/data/2026/CVE-2026-0175.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0175","lastModified":"2026-11-13T05:17:46.123","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.517","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0175","lastModified":"2026-11-13T14:17:45.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:05.587261Z","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.517","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-101295.json b/data/2026/CVE-2026-101295.json
index 77d90ef156..28615f20b4 100644
--- a/data/2026/CVE-2026-101295.json
+++ b/data/2026/CVE-2026-101295.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:assisted_installer:2"],"defaultStatus":"unknown","packageName":"assisted/agent-preinstall-image-builder-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/oc-mirror-plugin-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unknown","packageName":"openshift4/oc-mirror-plugin-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unknown","packageName":"openshift5/oc-mirror-plugin-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory."}],"id":"CVE-2026-101295","lastModified":"2026-10-30T09:17:11.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.5,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-101295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-30T19:43:00.483333Z","version":"2.0.3"}}]},"published":"2026-09-30T15:22:19.423","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-101295"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522941"},{"source":"secalert@redhat.com","url":"https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/catalog_images.go#L680"},{"source":"secalert@redhat.com","url":"https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/fbc_operators.go#L334-L369"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift4/oc-mirror-plugin-rhel8","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793823172","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/oc-mirror-plugin-rhel9","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793875992","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift4/oc-mirror-plugin-rhel9","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793907408","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:assisted_installer:2"],"defaultStatus":"unknown","packageName":"assisted/agent-preinstall-image-builder-rhel9","product":"Assisted Installer for Red Hat OpenShift Container Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unknown","packageName":"openshift5/oc-mirror-plugin-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory."}],"id":"CVE-2026-101295","lastModified":"2026-11-13T14:17:46.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.5,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-101295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-30T19:43:00.483333Z","version":"2.0.3"}}]},"published":"2026-09-30T15:22:19.423","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95746"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95756"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96283"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-101295"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2522941"},{"source":"secalert@redhat.com","url":"https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/catalog_images.go#L680"},{"source":"secalert@redhat.com","url":"https://github.com/openshift/oc-mirror/blob/22a5722/v1/pkg/cli/mirror/fbc_operators.go#L334-L369"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-103242.json b/data/2026/CVE-2026-103242.json
index 62d72383f1..dc8e624f3f 100644
--- a/data/2026/CVE-2026-103242.json
+++ b/data/2026/CVE-2026-103242.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"rpm","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"rpm","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}],"id":"CVE-2026-103242","lastModified":"2026-11-06T08:17:17.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103242","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-30T16:36:10.336744Z","version":"2.0.3"}}]},"published":"2026-09-30T12:17:12.653","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-103242"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543866"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"rpm-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"6.1.0-1.4.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"rpm","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"rpm","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package."}],"id":"CVE-2026-103242","lastModified":"2026-11-13T14:17:47.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103242","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-30T16:36:10.336744Z","version":"2.0.3"}}]},"published":"2026-09-30T12:17:12.653","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98095"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-103242"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543866"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-105880.json b/data/2026/CVE-2026-105880.json
new file mode 100644
index 0000000000..bd0ad9d996
--- /dev/null
+++ b/data/2026/CVE-2026-105880.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"webinar-ignition","product":"WebinarIgnition","vendor":"Tobias","versions":[{"changes":[{"at":"4.27.136","status":"unaffected"}],"lessThanOrEqual":"4.27.125","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarIgnition: from n/a through 4.27.125."}],"id":"CVE-2026-105880","lastModified":"2026-11-13T13:17:39.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:17:39.110","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/webinar-ignition/vulnerability/wordpress-webinarignition-plugin-4-27-125-insecure-direct-object-references-idor-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-10609.json b/data/2026/CVE-2026-10609.json
index f12ec0d86f..c3fb79e374 100644
--- a/data/2026/CVE-2026-10609.json
+++ b/data/2026/CVE-2026-10609.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:6"],"defaultStatus":"affected","packageName":"openshift-logging/cluster-logging-rhel9-operator","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:cluster_logging_operator:-:*:*:*:*:*:*:*","matchCriteriaId":"2A0B241E-0214-4C9D-B296-A84ED38C628A","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"EF93A27E-AA2B-4C2E-9B8D-FE7267847326","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges."},{"lang":"es","value":"Se encontró un defecto de autorización faltante en el OpenShift Cluster Logging Operator. El operador crea y reenvía tokens de ServiceAccount a destinos de salida sin verificar que el creador de ClusterLogForwarder tenga permiso para usar esas credenciales, permitiendo a un editor delegado exfiltrar tokens de SA y escalar privilegios."}],"id":"CVE-2026-10609","lastModified":"2026-10-25T23:10:00.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-10609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-06-23T13:58:23.388681Z","version":"2.0.3"}}]},"published":"2026-06-23T14:17:21.853","references":[{"source":"secalert@redhat.com","tags":["Mitigation","Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-10609"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483943"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:logging:6.5::el9"],"defaultStatus":"affected","packageName":"openshift-logging/cluster-logging-rhel9-operator","product":"Logging Subsystem for Red Hat OpenShift 6.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794255956","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:cluster_logging_operator:-:*:*:*:*:*:*:*","matchCriteriaId":"2A0B241E-0214-4C9D-B296-A84ED38C628A","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"EF93A27E-AA2B-4C2E-9B8D-FE7267847326","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use those credentials, allowing a delegated editor to exfiltrate SA tokens and escalate privileges."},{"lang":"es","value":"Se encontró un defecto de autorización faltante en el OpenShift Cluster Logging Operator. El operador crea y reenvía tokens de ServiceAccount a destinos de salida sin verificar que el creador de ClusterLogForwarder tenga permiso para usar esas credenciales, permitiendo a un editor delegado exfiltrar tokens de SA y escalar privilegios."}],"id":"CVE-2026-10609","lastModified":"2026-11-13T13:17:40.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-10609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-06-23T13:58:23.388681Z","version":"2.0.3"}}]},"published":"2026-06-23T14:17:21.853","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99823"},{"source":"secalert@redhat.com","tags":["Mitigation","Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-10609"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483943"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107174.json b/data/2026/CVE-2026-107174.json
index 90b2f8b09d..db995f5c42 100644
--- a/data/2026/CVE-2026-107174.json
+++ b/data/2026/CVE-2026-107174.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"affected","packageName":"openshift-serverless-1/kn-client-kn-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"affected","packageName":"openshift-serverless-1/kn-plugin-func-func-util-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"affected","packageName":"openshift-serverless-clients","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:source_to_image:1"],"defaultStatus":"affected","packageName":"source-to-image/source-to-image-rhel8","product":"OpenShift Source-to-Image (S2I)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:source_to_image:1"],"defaultStatus":"affected","packageName":"source-to-image/source-to-image-rhel9","product":"OpenShift Source-to-Image (S2I)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-docker-builder","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-docker-builder-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:webterminal:1"],"defaultStatus":"affected","packageName":"web-terminal/web-terminal-tooling-rhel9","product":"Red Hat Web Terminal","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system."}],"id":"CVE-2026-107174","lastModified":"2026-10-07T17:16:53.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-07T16:17:10.638072Z","version":"2.0.3"}}]},"published":"2026-10-07T15:17:19.190","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107174"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547419"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-61"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/openshift/source-to-image","defaultStatus":"unaffected","packageName":"source-to-image","versions":[{"lessThanOrEqual":"1.6.4","status":"affected","version":"0","versionType":"semver"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"affected","packageName":"openshift-serverless-1/kn-client-kn-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"affected","packageName":"openshift-serverless-1/kn-plugin-func-func-util-rhel9","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:serverless:1"],"defaultStatus":"affected","packageName":"openshift-serverless-clients","product":"OpenShift Serverless","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:source_to_image:1"],"defaultStatus":"affected","packageName":"source-to-image/source-to-image-rhel8","product":"OpenShift Source-to-Image (S2I)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:source_to_image:1"],"defaultStatus":"affected","packageName":"source-to-image/source-to-image-rhel9","product":"OpenShift Source-to-Image (S2I)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-docker-builder","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-docker-builder-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-docker-builder-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:webterminal:1"],"defaultStatus":"affected","packageName":"web-terminal/web-terminal-tooling-rhel9","product":"Red Hat Web Terminal","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system."}],"id":"CVE-2026-107174","lastModified":"2026-11-13T13:17:39.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-07T16:17:10.638072Z","version":"2.0.3"}}]},"published":"2026-10-07T15:17:19.190","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107174"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547419"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-61"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107525.json b/data/2026/CVE-2026-107525.json
new file mode 100644
index 0000000000..905b16e5f4
--- /dev/null
+++ b/data/2026/CVE-2026-107525.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dwll","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain service metadata useful for further attacks."}],"id":"CVE-2026-107525","lastModified":"2026-11-13T13:17:40.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:17:40.347","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-107526.json b/data/2026/CVE-2026-107526.json
new file mode 100644
index 0000000000..2ca3dcc2f3
--- /dev/null
+++ b/data/2026/CVE-2026-107526.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exploit this vulnerability, potentially leading to stored cross-site scripting in the management interface."}],"id":"CVE-2026-107526","lastModified":"2026-11-13T13:17:40.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:17:40.483","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-109095.json b/data/2026/CVE-2026-109095.json
new file mode 100644
index 0000000000..3a3dd8c3c4
--- /dev/null
+++ b/data/2026/CVE-2026-109095.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data."}],"id":"CVE-2026-109095","lastModified":"2026-11-13T14:17:47.367","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T14:17:47.260","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/99e647e914d947a791e92253a071955a9703647a"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"meissner@suse.de","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-109096.json b/data/2026/CVE-2026-109096.json
new file mode 100644
index 0000000000..6902d55b53
--- /dev/null
+++ b/data/2026/CVE-2026-109096.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect handling of negative returns from ddQueryImageAttributes()  when processing XvPutImage requests in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by authenticated X clients to crash the X server."}],"id":"CVE-2026-109096","lastModified":"2026-11-13T14:17:47.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T14:17:47.403","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/1376ac1f0edad6bd44dc6db3b4e49370a60d8e2f"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-805"}],"source":"meissner@suse.de","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-112314.json b/data/2026/CVE-2026-112314.json
index 4e4340cd0a..84abf8d3f9 100644
--- a/data/2026/CVE-2026-112314.json
+++ b/data/2026/CVE-2026-112314.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}],"id":"CVE-2026-112314","lastModified":"2026-11-13T02:18:50.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112314","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:57:01.092807Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:39.867","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112314"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478446"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478446"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}],"id":"CVE-2026-112314","lastModified":"2026-11-13T14:17:47.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112314","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:57:01.092807Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:39.867","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112314"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478446"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478446"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112315.json b/data/2026/CVE-2026-112315.json
index 76144c7b08..7b09fb93ca 100644
--- a/data/2026/CVE-2026-112315.json
+++ b/data/2026/CVE-2026-112315.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}],"id":"CVE-2026-112315","lastModified":"2026-11-13T00:20:08.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112315","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:21.668280Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.077","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112315"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479403"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}],"id":"CVE-2026-112315","lastModified":"2026-11-13T13:17:41.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112315","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:21.668280Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.077","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112315"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479403"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112316.json b/data/2026/CVE-2026-112316.json
index 1bf85f4bc1..2bfa83a492 100644
--- a/data/2026/CVE-2026-112316.json
+++ b/data/2026/CVE-2026-112316.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}],"id":"CVE-2026-112316","lastModified":"2026-11-13T00:20:08.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:01:26.177622Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.243","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112316"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479331"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}],"id":"CVE-2026-112316","lastModified":"2026-11-13T13:17:42.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:01:26.177622Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.243","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112316"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479331"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112317.json b/data/2026/CVE-2026-112317.json
index b00a0c65a8..657375f733 100644
--- a/data/2026/CVE-2026-112317.json
+++ b/data/2026/CVE-2026-112317.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}],"id":"CVE-2026-112317","lastModified":"2026-11-13T00:20:08.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.407","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112317"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479209"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}],"id":"CVE-2026-112317","lastModified":"2026-11-13T13:17:43.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.407","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112317"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479209"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112318.json b/data/2026/CVE-2026-112318.json
index 589671fa68..0ea9a091c0 100644
--- a/data/2026/CVE-2026-112318.json
+++ b/data/2026/CVE-2026-112318.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}],"id":"CVE-2026-112318","lastModified":"2026-11-13T00:20:08.680","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:40.560","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112318"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478792"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}],"id":"CVE-2026-112318","lastModified":"2026-11-13T14:17:47.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112318","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:07:06.907800Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.560","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112318"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478792"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112319.json b/data/2026/CVE-2026-112319.json
index 822215b791..0d5f65f5f3 100644
--- a/data/2026/CVE-2026-112319.json
+++ b/data/2026/CVE-2026-112319.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}],"id":"CVE-2026-112319","lastModified":"2026-11-13T00:20:08.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112319","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:34:58.762680Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.727","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112319"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478684"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478684"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}],"id":"CVE-2026-112319","lastModified":"2026-11-13T13:17:44.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112319","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T19:34:58.762680Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.727","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112319"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478684"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478684"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112320.json b/data/2026/CVE-2026-112320.json
index a960fab44d..ba0c8c30d2 100644
--- a/data/2026/CVE-2026-112320.json
+++ b/data/2026/CVE-2026-112320.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}],"id":"CVE-2026-112320","lastModified":"2026-11-13T00:20:08.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112320","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:24.602764Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.887","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112320"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478449"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}],"id":"CVE-2026-112320","lastModified":"2026-11-13T13:17:45.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112320","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:37:24.602764Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:40.887","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112320"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478449"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112321.json b/data/2026/CVE-2026-112321.json
index c02aa1df96..1c1d9d8830 100644
--- a/data/2026/CVE-2026-112321.json
+++ b/data/2026/CVE-2026-112321.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}],"id":"CVE-2026-112321","lastModified":"2026-11-13T00:20:09.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112321","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:02:10.203184Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:41.050","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112321"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478448"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}],"id":"CVE-2026-112321","lastModified":"2026-11-13T13:17:46.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112321","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T23:02:10.203184Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:41.050","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112321"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478448"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112322.json b/data/2026/CVE-2026-112322.json
index eb8c0d2f7f..538438f036 100644
--- a/data/2026/CVE-2026-112322.json
+++ b/data/2026/CVE-2026-112322.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}],"id":"CVE-2026-112322","lastModified":"2026-11-13T00:20:09.330","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112322","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:59:29.778085Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:41.207","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112322"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478445"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}],"id":"CVE-2026-112322","lastModified":"2026-11-13T13:17:47.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112322","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:59:29.778085Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:41.207","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112322"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478445"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112323.json b/data/2026/CVE-2026-112323.json
index ca339e98a6..dbfcecc341 100644
--- a/data/2026/CVE-2026-112323.json
+++ b/data/2026/CVE-2026-112323.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}],"id":"CVE-2026-112323","lastModified":"2026-11-13T00:20:09.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:41.360","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112323"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478440"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}],"id":"CVE-2026-112323","lastModified":"2026-11-13T13:17:48.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:41.360","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-112323"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478440"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112830.json b/data/2026/CVE-2026-112830.json
new file mode 100644
index 0000000000..5f8923e407
--- /dev/null
+++ b/data/2026/CVE-2026-112830.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"brizy","product":"Brizy","vendor":"Brizy","versions":[{"changes":[{"at":"2.8.26","status":"unaffected"}],"lessThanOrEqual":"2.8.25","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25."}],"id":"CVE-2026-112830","lastModified":"2026-11-13T13:17:48.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:17:48.380","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/brizy/vulnerability/wordpress-brizy-plugin-2-8-25-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-114406.json b/data/2026/CVE-2026-114406.json
index 95b41e6aec..7344bbec29 100644
--- a/data/2026/CVE-2026-114406.json
+++ b/data/2026/CVE-2026-114406.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-100.3.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-100.3.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-60.3.el6_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"nss","product":"Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.44.0-15.el6_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-70.3.el7_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-81.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.4::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.12::el8"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202610250235-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"413.92.202611041925-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"414.92.202610242240-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"416.94.202610242150-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"417.94.202611061051-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"418.94.202610242013-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.19.9.6.202610241701-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202610242033-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202610241345-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.22.9.8.202610241758-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:13::el7"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 13.0 - ELS","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.8.33-2.el7ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.2::el8"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 16.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.119-4.el8ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1::el9"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 17.1 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.20.68-2.el9ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0::el9"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Services on OpenShift 18.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.27.89-3.el9ost","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/service-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-cli-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-kube-adaptor-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-network-observer-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-network-observer-rhel9-operator","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-router-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"3.5.3-3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-system-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9"],"defaultStatus":"affected","packageName":"agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9","product":"agentic cluster security suite 0.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793102187","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management:4::el9"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-metrics-rhel9-operator","product":"Cost Management 4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793202662","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.11::el9"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-central-db-rhel9","product":"Red Hat Advanced Cluster Security for Kubernetes 4.11","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793745312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.10::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-central-db-rhel8","product":"Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793184257","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cpu-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444554","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444456","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444339","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444409","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-gaudi-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444510","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444600","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-ui-rhel10","product":"Red Hat Cost Management On-Premise 1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793825318","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-server-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793734080","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-ui-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793733716","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"ca-certificates-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2026.2.92_v9.0.319-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041986","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042072","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042067","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041987","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793329709","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793328358","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042145","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042011","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042086","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042088","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-6.4-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041995","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042074","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042008","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793326837","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042010","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042162","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042004","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rubin-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042092","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042117","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042114","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.14-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042024","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042008","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793327660","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/guidellm-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793719302","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-controller-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792840135","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-git-cloner-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835365","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-bundler-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835298","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-processing-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792836805","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-rhel9-operator","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792844269","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837466","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-webhook-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792838794","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-waiters-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837567","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-webhook-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792851895","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-controller-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837598","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-git-cloner-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837398","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-bundler-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792838765","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-processing-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835879","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-rhel10-operator","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792859629","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792857112","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-webhook-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792840655","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-waiters-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792839475","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-webhook-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835571","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el10"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793043152","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/code-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793055196","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/code-sshd-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793053893","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/configbump-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033767","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/dashboard-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793040801","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/devspaces-rhel9-operator","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033165","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/imagepuller-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793036189","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/jetbrains-ide-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793036500","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/multicluster-redirector-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793037970","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/oauth2-proxy-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793034989","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/openvsx-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793038501","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/pluginregistry-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793050419","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/server-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041480","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033496","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041345","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793120195","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:windows_machine_config:11.0::el9"],"defaultStatus":"affected","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 11.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793279001","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686180","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682120","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685934","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685630","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685815","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682423","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682753","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682099","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685996","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682096","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691592","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692526","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691769","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692411","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691749","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691990","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691538","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692079","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691784","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691455","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684635","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684783","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686869","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-promoter-extension-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685916","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685284","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684716","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-4-18-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686175","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685138","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685777","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-promoter-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684735","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685586","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685190","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684655","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-kubernetes-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005764","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/haproxy-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793004999","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793004989","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005812","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-cpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-gaudi-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-neuron-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-omni-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-rocm-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-spyre-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii/vllm-neuron-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhdh:1"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhdh:2"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-aws-cuda-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-azure-cuda-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-azure-rocm-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-cuda-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gaudi-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gcp-cuda-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-rocm-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cpu-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cuda-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-rocm-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-spyre-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-torch-2.14-cpu-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-torch-2.14-cuda-13.0-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai-early-access/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhai-early-access/docling-sdk-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhai-early-access/docling-serve-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-payload-processing-e2e-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-payload-processing-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-authbridge-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-built-in-detector-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-caikit-nlp-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-caikit-tgis-serving-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-codeflare-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-feast-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-feast-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-feature-server-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-fms-guardrails-orchestrator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-guardrails-detector-huggingface-runtime-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-agent-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-autogluon-server-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-localmodel-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-localmodelnode-agent-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-router-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-storage-initializer-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kube-auth-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kueue-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-latency-predictor-prediction-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-latency-predictor-training-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llama-stack-core-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-async-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-apiserver-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-gc-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-processor-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-inference-scheduler-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-kv-cache-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-router-disagg-sidecar-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-router-endpoint-picker-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-routing-sidecar-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-maas-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mcp-lifecycle-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mcp-lifecycle-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mlmd-grpc-server-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-api-server-v2-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-driver-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-launcher-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-runtime-generic-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mlserver-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mlserver-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mm-rest-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-runtime-adapter-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-serving-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-model-metadata-collection-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-model-performance-data-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-job-async-upload-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-must-gather-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-core-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-openvino-model-server-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipelines-components-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-rhaii-cluster-validator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-rhaii-validator-tools-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-rhel9-operator","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-spark-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ta-lmes-driver-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ta-lmes-job-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-cpu-torch210-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-th06-cpu-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-trainer-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda121-torch24-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda124-torch25-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda128-torch28-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda128-torch29-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm62-torch24-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm62-torch25-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch28-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch29-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-nemo-guardrails-server-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-service-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-gaudi-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-rocm-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workload-variant-autoscaler-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/rhai-cli-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed."}],"id":"CVE-2026-114406","lastModified":"2026-11-11T06:17:11.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T20:11:04.886053Z","version":"2.0.3"}}]},"published":"2026-10-21T21:17:58.547","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:86595"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88455"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88550"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88560"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88562"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88563"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88564"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88662"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88668"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88669"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88779"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89081"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89131"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89197"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89333"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89651"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89714"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89725"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89838"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89907"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90272"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90969"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90985"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91202"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91204"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91206"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91207"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91217"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91218"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91219"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91224"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91233"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91234"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91235"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91236"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91237"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91238"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91241"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91242"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91243"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91244"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91245"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91246"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91248"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91249"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91997"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:92006"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:92342"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93043"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93044"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93045"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93046"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94468"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94474"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94476"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94562"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94583"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94584"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94631"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94702"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94709"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94717"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94721"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94738"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94802"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95058"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95090"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95264"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95365"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95745"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96282"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114406"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556046"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-100.3.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-100.3.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-60.3.el6_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"nss","product":"Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.44.0-15.el6_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-70.3.el7_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-81.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.4::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6::baseos","cpe:/o:redhat:rhel_eus_long_life:8.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-80.3.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.4::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6::baseos"],"defaultStatus":"affected","packageName":"ca-certificates","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2026.2.92_v9.0.319-90.3.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.12::el8"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202610250235-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"413.92.202611041925-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"414.92.202610242240-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"416.94.202610242150-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"417.94.202611061051-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"418.94.202610242013-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.19.9.6.202610241701-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202610242033-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202610241345-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.22.9.8.202610241758-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:13::el7"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 13.0 - ELS","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.8.33-2.el7ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:16.2::el8"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 16.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.12.119-4.el8ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1::el9"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Platform 17.1 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.20.68-2.el9ost","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0::el9"],"defaultStatus":"affected","packageName":"python-botocore","product":"Red Hat OpenStack Services on OpenShift 18.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.27.89-3.el9ost","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/service-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-cli-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-kube-adaptor-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-network-observer-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-network-observer-rhel9-operator","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-router-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"3.5.3-3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:service_interconnect:2.0::el9"],"defaultStatus":"affected","packageName":"service-interconnect/skupper-system-controller-rhel9","product":"Service Interconnect 2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.2.4-2","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9"],"defaultStatus":"affected","packageName":"agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9","product":"agentic cluster security suite 0.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793102187","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management:4::el9"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-metrics-rhel9-operator","product":"Cost Management 4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793202662","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.11::el9"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-central-db-rhel9","product":"Red Hat Advanced Cluster Security for Kubernetes 4.11","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793745312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:advanced_cluster_security:4.10::el8"],"defaultStatus":"affected","packageName":"advanced-cluster-security/rhacs-central-db-rhel8","product":"Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793184257","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793961846","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793962303","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.2::el9"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793961309","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398074","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cpu-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398071","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794418334","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398147","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.4::el9"],"defaultStatus":"affected","packageName":"rhaii/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794398157","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cpu-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444554","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-rocm-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444456","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444339","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-spyre-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444409","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-gaudi-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444510","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ai_inference_server:3.5::el9"],"defaultStatus":"affected","packageName":"rhaii/vllm-cuda-rhel9","product":"Red Hat AI Inference Server 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793444600","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-ui-rhel10","product":"Red Hat Cost Management On-Premise 1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793825318","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-server-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793734080","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:discovery:2::el9"],"defaultStatus":"affected","packageName":"discovery/discovery-ui-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793733716","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/disk-image-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793995863","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-aws-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-azure-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-azure-rocm-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973314","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793914518","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gcp-cuda-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793973312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhelai3/bootc-rocm-rhel9","product":"Red Hat Enterprise Linux AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793914504","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"ca-certificates-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2026.2.92_v9.0.319-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041986","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042072","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042067","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041987","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793329709","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793328358","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042145","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042011","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042086","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042088","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-6.4-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041995","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042074","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042008","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793326837","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042010","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042162","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042004","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rubin-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042092","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042117","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042114","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.14-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042024","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793042008","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793327660","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/guidellm-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793719302","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793869589","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-payload-processing-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759494","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-automl-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763148","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-autorag-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761178","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-built-in-detector-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793402315","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-cli-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757717","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761673","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757463","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758906","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757981","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761044","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756253","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-eval-hub-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760703","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feast-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793755520","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feast-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793630340","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-feature-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758949","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-fms-guardrails-orchestrator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793765218","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-guardrails-detector-huggingface-runtime-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793403223","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757743","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-agent-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793766233","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-autogluon-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776192","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764826","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759522","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-localmodel-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793768650","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-localmodelnode-agent-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761860","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793867964","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-router-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761723","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kserve-storage-initializer-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691340","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kube-auth-proxy-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793770093","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793602161","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756370","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-latency-predictor-prediction-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793646667","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-latency-predictor-training-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793767642","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-async-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760437","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-apiserver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760171","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-gc-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761642","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764510","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-batch-gateway-processor-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759957","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-router-disagg-sidecar-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756751","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-router-endpoint-picker-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793756521","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-maas-api-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793762624","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793766456","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763734","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793584398","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlmd-grpc-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793607972","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-api-server-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793765658","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-driver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763787","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-launcher-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759883","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758891","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763216","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlserver-cuda-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760043","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mlserver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793762133","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758732","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758836","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757264","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758686","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759162","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757908","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793758359","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763697","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793759904","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-metadata-collection-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793298535","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-performance-data-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793300494","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-job-async-upload-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793799006","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776221","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-registry-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793798983","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763721","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-must-gather-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793770107","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793760033","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-core-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793383222","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793761401","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764752","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-openvino-model-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793455001","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793679560","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-pipelines-components-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793764886","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhaii-cluster-validator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776868","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhaii-validator-tools-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776772","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-rhel9-operator","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793872681","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-spark-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778378","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ta-lmes-driver-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793776034","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-ta-lmes-job-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793398367","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-cpu-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793688471","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793715343","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-th-torch-rocm-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793680216","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trainer-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793775975","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda128-torch28-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763288","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda128-torch29-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763316","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793777468","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch28-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763250","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm64-torch29-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793763220","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793497091","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-nemo-guardrails-server-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793369260","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778341","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-service-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793777246","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793381112","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793778341","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685856","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793677376","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-workload-variant-autoscaler-controller-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793606223","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhoai/rhai-cli-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793757717","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-controller-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792840135","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-git-cloner-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835365","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-bundler-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835298","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-processing-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792836805","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-rhel9-operator","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792844269","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837466","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-webhook-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792838794","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-waiters-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837567","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.8::el9"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-webhook-rhel9","product":"Red Hat OpenShift Builds 1.8.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792851895","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-controller-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837598","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-git-cloner-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792837398","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-bundler-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792838765","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-image-processing-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835879","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-rhel10-operator","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792859629","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792857112","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-shared-resource-webhook-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792840655","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-waiters-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792839475","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_builds:1.9::el10"],"defaultStatus":"affected","packageName":"openshift-builds/openshift-builds-webhook-rhel10","product":"Red Hat OpenShift Builds 1.9.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792835571","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el10"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793043152","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/code-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793055196","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/code-sshd-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793053893","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/configbump-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033767","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/dashboard-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793040801","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/devspaces-rhel9-operator","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033165","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/imagepuller-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793036189","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/jetbrains-ide-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793036500","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/multicluster-redirector-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793037970","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/oauth2-proxy-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793034989","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/openvsx-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793038501","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/pluginregistry-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793050419","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/server-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041480","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/traefik-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793033496","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793041345","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.31::el9"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces 3.31","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793120195","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:windows_machine_config:11.0::el9"],"defaultStatus":"affected","packageName":"openshift4-wincw/windows-machine-config-rhel9-operator","product":"Red Hat OpenShift for Windows Containers 11.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793279001","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686180","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682120","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685934","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685630","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685815","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682423","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682753","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682099","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685996","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.20::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793682096","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691592","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692526","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691769","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692411","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691749","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691990","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691538","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793692079","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691784","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.21::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793691455","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-agent-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684635","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-extensions-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684783","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-image-updater-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686869","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-promoter-extension-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685916","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argocd-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685284","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/argo-rollouts-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684716","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-4-18-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793686175","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/console-plugin-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685138","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/dex-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685777","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-promoter-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684735","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685586","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/gitops-rhel9-operator","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793685190","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_gitops:1.22::el9"],"defaultStatus":"affected","packageName":"openshift-gitops-1/must-gather-rhel9","product":"Red Hat OpenShift GitOps 1.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793684655","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-kubernetes-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005764","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/haproxy-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793004999","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793004989","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793005812","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/model-opt-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-cpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-gaudi-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-neuron-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-omni-cuda-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-rocm-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-spyre-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii-fast/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii/vllm-neuron-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaii/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhdh:1"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhdh:2"],"defaultStatus":"affected","packageName":"rhdh/rhdh-hub-rhel9","product":"Red Hat Developer Hub 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"],"defaultStatus":"affected","packageName":"rhelai3/bootc-gaudi-rhel9","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cpu-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-cuda-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-rocm-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-spyre-stable-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-torch-2.14-cpu-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai/base-image-torch-2.14-cuda-13.0-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhai-early-access/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhai-early-access/docling-sdk-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhai-early-access/docling-serve-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ai-gateway-payload-processing-e2e-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-authbridge-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-caikit-nlp-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-caikit-tgis-serving-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-codeflare-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kueue-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llama-stack-core-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-inference-scheduler-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-kv-cache-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-llm-d-routing-sidecar-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mcp-lifecycle-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mcp-lifecycle-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-ml-pipelines-runtime-generic-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mm-rest-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-runtime-adapter-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-serving-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-cpu-torch210-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-th06-cpu-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda121-torch24-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-cuda124-torch25-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm62-torch24-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-training-rocm62-torch25-py311-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-cuda-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-gaudi-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-vllm-rocm-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed."}],"id":"CVE-2026-114406","lastModified":"2026-11-13T13:17:48.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114406","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-02T20:11:04.886053Z","version":"2.0.3"}}]},"published":"2026-10-21T21:17:58.547","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:86595"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88455"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88550"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88560"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88562"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88563"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88564"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88662"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88668"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88669"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88779"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89081"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89131"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89197"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89333"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89651"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89714"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89725"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89838"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89907"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90272"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90969"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90985"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91202"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91204"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91206"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91207"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91217"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91218"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91219"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91224"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91232"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91233"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91234"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91235"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91236"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91237"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91238"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91241"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91242"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91243"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91244"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91245"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91246"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91248"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91249"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:91997"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:92006"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:92342"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93043"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93044"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93045"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93046"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94459"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94468"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94474"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94476"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94562"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94583"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94584"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94631"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94702"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94709"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94717"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94721"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94738"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94802"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95058"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95090"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95264"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95365"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95745"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95872"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96282"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96323"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96333"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96400"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96403"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96406"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99787"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99792"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99794"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99796"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99800"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114406"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556046"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-114690.json b/data/2026/CVE-2026-114690.json
index adb4d1c46f..84fbe5e954 100644
--- a/data/2026/CVE-2026-114690.json
+++ b/data/2026/CVE-2026-114690.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"16.2.1-3.2.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}],"id":"CVE-2026-114690","lastModified":"2026-11-13T05:17:48.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T15:20:50.353340Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.047","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98115"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114690"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478652"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"16.2.1-3.2.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"13.5.0-0.5.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}],"id":"CVE-2026-114690","lastModified":"2026-11-13T13:17:50.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T15:20:50.353340Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.047","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95981"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98115"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114690"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478652"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-114691.json b/data/2026/CVE-2026-114691.json
index 35732be36b..3e2ebea2fa 100644
--- a/data/2026/CVE-2026-114691.json
+++ b/data/2026/CVE-2026-114691.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"16.2.1-3.2.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}],"id":"CVE-2026-114691","lastModified":"2026-11-13T05:17:51.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T16:58:15.100212Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.257","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98115"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114691"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478508"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb","cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.0-31.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"16.2.1-3.2.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"13.5.0-0.5.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}],"id":"CVE-2026-114691","lastModified":"2026-11-13T13:17:51.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T16:58:15.100212Z","version":"2.0.3"}}]},"published":"2026-10-30T08:16:55.257","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95981"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98115"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-114691"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478508"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-115456.json b/data/2026/CVE-2026-115456.json
index 59e8722649..f1122d019f 100644
--- a/data/2026/CVE-2026-115456.json
+++ b/data/2026/CVE-2026-115456.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"16.2.1-3.2.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}],"id":"CVE-2026-115456","lastModified":"2026-11-13T05:17:56.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T15:28:14.595258Z","version":"2.0.3"}}]},"published":"2026-10-30T09:17:14.413","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-115456"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563044"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-8.2.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.4.1-5.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.3.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-15-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:15.2.1-7.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gcc-toolset-16-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.2.1-1.4.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:11.5.0-17.el9_9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"16.2.1-3.2.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gcc13-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"13.5.0-0.5.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-295","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-296","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-32","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-34","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"compat-gcc-44","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gcc-toolset-14-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mingw-gcc","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"affected","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}],"id":"CVE-2026-115456","lastModified":"2026-11-13T14:17:47.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-30T15:28:14.595258Z","version":"2.0.3"}}]},"published":"2026-10-30T09:17:14.413","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95581"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95981"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98524"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98526"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98534"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98633"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98648"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-115456"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563044"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116411.json b/data/2026/CVE-2026-116411.json
new file mode 100644
index 0000000000..0a21543bf6
--- /dev/null
+++ b/data/2026/CVE-2026-116411.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to information disclosure via requests to internal services."}],"id":"CVE-2026-116411","lastModified":"2026-11-13T14:17:48.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:17:48.130","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116412.json b/data/2026/CVE-2026-116412.json
new file mode 100644
index 0000000000..8f193e45a9
--- /dev/null
+++ b/data/2026/CVE-2026-116412.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an insecure-file-permissions vulnerability. A local low-privileged attacker could exploit this vulnerability to disclose administrative credentials."}],"id":"CVE-2026-116412","lastModified":"2026-11-13T14:17:48.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:17:48.263","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116413.json b/data/2026/CVE-2026-116413.json
new file mode 100644
index 0000000000..9e0474721b
--- /dev/null
+++ b/data/2026/CVE-2026-116413.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impersonate another identity, potentially leading to unauthorized access."}],"id":"CVE-2026-116413","lastModified":"2026-11-13T14:17:48.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:17:48.390","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-116645.json b/data/2026/CVE-2026-116645.json
index cac1ca10b5..19dd885b56 100644
--- a/data/2026/CVE-2026-116645.json
+++ b/data/2026/CVE-2026-116645.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"LimeSurvey Community Edition","repo":"https://github.com/LimeSurvey/LimeSurvey","vendor":"LimeSurvey","versions":[{"status":"affected","version":"7.8.0"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges."}],"id":"CVE-2026-116645","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-11T03:16:48.630","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/pantera"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/admin/import_helper.php"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/export_helper.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"help@fluidattacks.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"LimeSurvey Community Edition","repo":"https://github.com/LimeSurvey/LimeSurvey","vendor":"LimeSurvey","versions":[{"status":"affected","version":"7.8.0"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named attribute column. When the user exports responses from the imported non-anonymous survey, LimeSurvey passes the persisted name to Yii's select builder. Names containing parentheses are treated as SQL expressions instead of quoted identifiers, causing attacker-controlled SQL to execute with the application's database privileges."}],"id":"CVE-2026-116645","lastModified":"2026-11-13T14:17:48.520","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116645","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:33:11.556092Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:48.630","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/pantera"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/admin/import_helper.php"},{"source":"help@fluidattacks.com","url":"https://github.com/LimeSurvey/LimeSurvey/blob/master/application/helpers/export_helper.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"help@fluidattacks.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118368.json b/data/2026/CVE-2026-118368.json
index 28b57f60f7..e3727bfd60 100644
--- a/data/2026/CVE-2026-118368.json
+++ b/data/2026/CVE-2026-118368.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin."}],"id":"CVE-2026-118368","lastModified":"2026-11-12T20:07:11.090","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-11T05:19:27.373","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/tool"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Imports/Common/Sheets/Items.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/documents/form/line-item.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin."}],"id":"CVE-2026-118368","lastModified":"2026-11-13T14:17:48.663","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118368","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:32:16.586717Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:27.373","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/es/advisories/tool"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Imports/Common/Sheets/Items.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/documents/form/line-item.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-119079.json b/data/2026/CVE-2026-119079.json
index b6b93dcf57..7797d7c671 100644
--- a/data/2026/CVE-2026-119079.json
+++ b/data/2026/CVE-2026-119079.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}],"id":"CVE-2026-119079","lastModified":"2026-11-13T00:20:09.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T19:16:43.023","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119079"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479231"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-408"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-11.el10_3.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.3-10.el10_2.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_9.2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.21.1-10.el9_8.3","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"krb5-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.3-0.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"krb5","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"krb5","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}],"id":"CVE-2026-119079","lastModified":"2026-11-13T13:17:53.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119079","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:37:56.550556Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:43.023","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97811"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99624"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99625"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99716"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119079"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479231"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479231"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-408"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-119518.json b/data/2026/CVE-2026-119518.json
new file mode 100644
index 0000000000..840f7f66fb
--- /dev/null
+++ b/data/2026/CVE-2026-119518.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"royal-elementor-addons","product":"Royal Elementor Addons","vendor":"WProyal","versions":[{"changes":[{"at":"1.7.1071","status":"unaffected"}],"lessThanOrEqual":"1.7.1070","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070."}],"id":"CVE-2026-119518","lastModified":"2026-11-13T13:17:54.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:17:54.187","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-plugin-1-7-1070-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-119743.json b/data/2026/CVE-2026-119743.json
index a5016cf88c..80e9466c43 100644
--- a/data/2026/CVE-2026-119743.json
+++ b/data/2026/CVE-2026-119743.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/pdfmake","product":"pdfmake","repo":"https://github.com/bpampuch/pdfmake","vendor":"bpampuch","versions":[{"lessThan":"0.3.14","status":"affected","version":"0.3.0-beta.1","versionType":"semver"},{"lessThan":"0.2.23","status":"unaffected","version":"0.2.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy."}],"id":"CVE-2026-119743","lastModified":"2026-11-12T21:35:47.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T14:17:06.573","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/bpampuch/pdfmake/commit/73aaed7a90699f31036a77f957fe3303693e3c8f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bpampuch/pdfmake/releases/tag/0.3.14"},{"source":"disclosure@vulncheck.com","url":"https://github.com/pdfmake/docs/commit/e8a6e2b2bf728f457ed65c7a1642db7b8446592e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pdfmake-shared-cache-access-policy-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/pdfmake","product":"pdfmake","repo":"https://github.com/bpampuch/pdfmake","vendor":"bpampuch","versions":[{"lessThan":"0.3.14","status":"affected","version":"0.3.0-beta.1","versionType":"semver"},{"lessThan":"0.2.23","status":"unaffected","version":"0.2.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy."}],"id":"CVE-2026-119743","lastModified":"2026-11-13T13:17:54.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119743","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:06:43.428699Z","version":"2.0.3"}}]},"published":"2026-11-09T14:17:06.573","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/bpampuch/pdfmake/commit/73aaed7a90699f31036a77f957fe3303693e3c8f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bpampuch/pdfmake/releases/tag/0.3.14"},{"source":"disclosure@vulncheck.com","url":"https://github.com/pdfmake/docs/commit/e8a6e2b2bf728f457ed65c7a1642db7b8446592e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pdfmake-shared-cache-access-policy-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120749.json b/data/2026/CVE-2026-120749.json
index 6603c74c06..2eb74132cf 100644
--- a/data/2026/CVE-2026-120749.json
+++ b/data/2026/CVE-2026-120749.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"dbus","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"dbus","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unknown","packageName":"dbus","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"dbus","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"dbus","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"dbus","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon."}],"id":"CVE-2026-120749","lastModified":"2026-11-10T05:17:58.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120749","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:50:39.247231Z","version":"2.0.3"}}]},"published":"2026-11-06T07:17:06.153","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-120749"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567978"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/565"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/592"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/dbus/dbus/-/work_items/576"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"dbus-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.16.2-7.1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"dbus","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"dbus","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unknown","packageName":"dbus","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"dbus","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"dbus","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon."}],"id":"CVE-2026-120749","lastModified":"2026-11-13T14:17:48.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120749","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:50:39.247231Z","version":"2.0.3"}}]},"published":"2026-11-06T07:17:06.153","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:97846"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-120749"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567978"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/565"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/592"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/dbus/dbus/-/work_items/576"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120977.json b/data/2026/CVE-2026-120977.json
index 635927dfa7..f032e4008f 100644
--- a/data/2026/CVE-2026-120977.json
+++ b/data/2026/CVE-2026-120977.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7700R4 Series","7800R3/R4 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.32.0F","status":"affected","version":"4.31.2F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges."}],"id":"CVE-2026-120977","lastModified":"2026-11-13T05:18:12.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120977","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:18:52.800","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7700R4 Series","7800R3/R4 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.32.0F","status":"affected","version":"4.31.2F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adjacent attacker can send a crafted DHCP packet to force the device to record a spoofed device profile. This may potentially allow the authenticated supplicant to acquire unauthorized access to a network segment with elevated privileges."}],"id":"CVE-2026-120977","lastModified":"2026-11-13T14:17:48.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120977","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:16.425048Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:52.800","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25039-security-advisory-0217"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121287.json b/data/2026/CVE-2026-121287.json
index 7ed71082c0..0dc1138946 100644
--- a/data/2026/CVE-2026-121287.json
+++ b/data/2026/CVE-2026-121287.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device."}],"id":"CVE-2026-121287","lastModified":"2026-11-13T05:18:12.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121287","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:18:53.950","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device."}],"id":"CVE-2026-121287","lastModified":"2026-11-13T14:17:49.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121287","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:12.976294Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:53.950","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-124"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121721.json b/data/2026/CVE-2026-121721.json
new file mode 100644
index 0000000000..dbad7b1040
--- /dev/null
+++ b/data/2026/CVE-2026-121721.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"advanced-gutenberg","product":"Gutenberg Blocks","vendor":"PublishPress","versions":[{"changes":[{"at":"3.7.7","status":"unaffected"}],"lessThanOrEqual":"3.7.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Stored XSS.This issue affects Gutenberg Blocks: from n/a through 3.7.6."}],"id":"CVE-2026-121721","lastModified":"2026-11-13T13:17:55.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:17:55.390","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-plugin-3-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-121771.json b/data/2026/CVE-2026-121771.json
new file mode 100644
index 0000000000..6bb82c4e6f
--- /dev/null
+++ b/data/2026/CVE-2026-121771.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"advanced-gutenberg","product":"Gutenberg Blocks","vendor":"PublishPress","versions":[{"changes":[{"at":"3.7.7","status":"unaffected"}],"lessThanOrEqual":"3.7.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6."}],"id":"CVE-2026-121771","lastModified":"2026-11-13T13:17:55.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:17:55.537","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-plugin-3-7-6-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-121885.json b/data/2026/CVE-2026-121885.json
index 40d7b80252..b508224e36 100644
--- a/data/2026/CVE-2026-121885.json
+++ b/data/2026/CVE-2026-121885.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/podman-container-tools/podman","defaultStatus":"unaffected","packageName":"podman","versions":[{"lessThan":"5.8.10","status":"affected","version":"1.8.2","versionType":"semver"},{"lessThan":"6.2.0","status":"affected","version":"6.0.0","versionType":"semver"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"container-tools:rhel8/podman","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges."}],"id":"CVE-2026-121885","lastModified":"2026-11-11T08:17:17.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121885","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:18:36.758499Z","version":"2.0.3"}}]},"published":"2026-11-10T15:17:15.880","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-121885"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2566844"},{"source":"secalert@redhat.com","url":"https://github.com/podman-container-tools/podman/security/advisories/GHSA-55rm-rwr7-q2wr"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/podman-container-tools/podman","defaultStatus":"unaffected","packageName":"podman","versions":[{"lessThan":"5.8.10","status":"affected","version":"1.8.2","versionType":"semver"},{"lessThan":"6.2.0","status":"affected","version":"6.0.0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"podman-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"6.1.4-1.4.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"container-tools:rhel8/podman","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges."}],"id":"CVE-2026-121885","lastModified":"2026-11-13T14:17:49.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121885","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:18:36.758499Z","version":"2.0.3"}}]},"published":"2026-11-10T15:17:15.880","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98992"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-121885"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2566844"},{"source":"secalert@redhat.com","url":"https://github.com/podman-container-tools/podman/security/advisories/GHSA-55rm-rwr7-q2wr"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-122056.json b/data/2026/CVE-2026-122056.json
index af175eeceb..4fff43dea9 100644
--- a/data/2026/CVE-2026-122056.json
+++ b/data/2026/CVE-2026-122056.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"openscap","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS)."}],"id":"CVE-2026-122056","lastModified":"2026-11-11T21:16:42.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T22:18:34.163","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-122056"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567100"},{"source":"secalert@redhat.com","url":"https://github.com/OpenSCAP/openscap/security/advisories/GHSA-5h6x-q65w-wxvf"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"openscap","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"openscap","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS)."}],"id":"CVE-2026-122056","lastModified":"2026-11-13T13:17:55.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122056","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:10:55.708342Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:34.163","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-122056"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567100"},{"source":"secalert@redhat.com","url":"https://github.com/OpenSCAP/openscap/security/advisories/GHSA-5h6x-q65w-wxvf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/OpenSCAP/openscap/security/advisories/GHSA-5h6x-q65w-wxvf"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123041.json b/data/2026/CVE-2026-123041.json
index 736b5ca154..bdcca208ec 100644
--- a/data/2026/CVE-2026-123041.json
+++ b/data/2026/CVE-2026-123041.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another."}],"id":"CVE-2026-123041","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:18:28.870","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another."}],"id":"CVE-2026-123041","lastModified":"2026-11-13T14:17:49.347","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123041","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:41:08.902054Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:28.870","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123368.json b/data/2026/CVE-2026-123368.json
index 920b18f1ba..ba280a0293 100644
--- a/data/2026/CVE-2026-123368.json
+++ b/data/2026/CVE-2026-123368.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"compose-lint","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.22.0, < 0.31.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0."}],"id":"CVE-2026-123368","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T18:17:25.683","references":[{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/pull/917"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"compose-lint","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.22.0, < 0.31.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0."}],"id":"CVE-2026-123368","lastModified":"2026-11-13T13:17:56.717","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123368","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:23:23.996544Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:25.683","references":[{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/commit/c43204ad4dab11d54e20574a52bc4e5835246ca5"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/pull/917"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-6wcv-rj3c-mhv3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123372.json b/data/2026/CVE-2026-123372.json
index 8f44a887fe..61c0759bfa 100644
--- a/data/2026/CVE-2026-123372.json
+++ b/data/2026/CVE-2026-123372.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"compose-lint","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.22.0, < 0.32.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0."}],"id":"CVE-2026-123372","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T18:17:26.320","references":[{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/pull/944"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-532"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"compose-lint","vendor":"tmatens","versions":[{"status":"affected","version":">= 0.22.0, < 0.32.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0."}],"id":"CVE-2026-123372","lastModified":"2026-11-13T13:17:57.740","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123372","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:28:46.518093Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:26.320","references":[{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/commit/977da9724789264c2662afe47f79220e915442c2"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/pull/944"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-jf3h-8jvx-vcrg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-532"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123710.json b/data/2026/CVE-2026-123710.json
index 3018f329ad..fc709702f5 100644
--- a/data/2026/CVE-2026-123710.json
+++ b/data/2026/CVE-2026-123710.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/quay/quay","defaultStatus":"unaffected","packageName":"quay","product":"quay","vendor":"Project Quay","versions":[{"lessThan":"3.9.28","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.10.28","status":"affected","version":"3.10.0","versionType":"semver"},{"lessThan":"3.12.24","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.10","status":"affected","version":"3.14.0","versionType":"semver"},{"lessThan":"3.15.9","status":"affected","version":"3.15.0","versionType":"semver"},{"lessThan":"3.16.7","status":"affected","version":"3.16.0","versionType":"semver"},{"lessThan":"3.17.7","status":"affected","version":"3.17.0","versionType":"semver"},{"lessThan":"3.18.3","status":"affected","version":"3.18.0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993674","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993854","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.14::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993848","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.15::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993799","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993778","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.18::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993890","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993730","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:5"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags."}],"id":"CVE-2026-123710","lastModified":"2026-11-13T02:18:50.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T15:17:18.340","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99019"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99021"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99022"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99023"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99024"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99025"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99026"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99027"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123710"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/solutions/7149923"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2568072"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/quay/quay","defaultStatus":"unaffected","packageName":"quay","product":"quay","vendor":"Project Quay","versions":[{"lessThan":"3.9.28","status":"affected","version":"0","versionType":"semver"},{"lessThan":"3.10.28","status":"affected","version":"3.10.0","versionType":"semver"},{"lessThan":"3.12.24","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.10","status":"affected","version":"3.14.0","versionType":"semver"},{"lessThan":"3.15.9","status":"affected","version":"3.15.0","versionType":"semver"},{"lessThan":"3.16.7","status":"affected","version":"3.16.0","versionType":"semver"},{"lessThan":"3.17.7","status":"affected","version":"3.17.0","versionType":"semver"},{"lessThan":"3.18.3","status":"affected","version":"3.18.0","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.10::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993674","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.12::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993854","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.14::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993848","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.15::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993771","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.16::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993799","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.17::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993778","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.18::el9"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 3.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993890","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:quay:3.9::el8"],"defaultStatus":"affected","packageName":"quay/quay-rhel8","product":"Red Hat Quay 3.9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793993730","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:quay:5"],"defaultStatus":"affected","packageName":"quay/quay-rhel9","product":"Red Hat Quay 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags."}],"id":"CVE-2026-123710","lastModified":"2026-11-13T02:18:50.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T15:17:18.340","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99019"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99021"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99022"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99023"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99024"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99025"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99026"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99027"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123710"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/solutions/7149923"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2568072"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123798.json b/data/2026/CVE-2026-123798.json
index eaf260d052..b157f5a19d 100644
--- a/data/2026/CVE-2026-123798.json
+++ b/data/2026/CVE-2026-123798.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"supertokens-core","vendor":"supertokens","versions":[{"status":"affected","version":">= 12.0.6, < 12.0.10"},{"status":"affected","version":">= 11.4.0, < 11.4.7"},{"status":"affected","version":">= 11.3.0, < 11.3.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10."}],"id":"CVE-2026-123798","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T19:16:46.280","references":[{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"supertokens-core","vendor":"supertokens","versions":[{"status":"affected","version":">= 12.0.6, < 12.0.10"},{"status":"affected","version":">= 11.4.0, < 11.4.7"},{"status":"affected","version":">= 11.3.0, < 11.3.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.7, 11.4.7, and 12.0.10, SAML.verifySamlResponseSignature calls OpenSAML SignatureValidator.validate without first applying SAMLSignatureProfileValidator. The Core can therefore accept a cryptographically valid signature that references a different XML element from the Response or Assertion whose NameID and attributes are used for authentication. An ordinary user of the configured identity provider can move a genuinely signed element elsewhere in the document while supplying an attacker-authored identity-bearing element, causing XML Signature Wrapping authentication as another IdP user. Both response-level and assertion-level signing paths are affected, and SP-initiated login remains reachable without enabling allowIDPInitiatedLogin. This issue is fixed in versions 11.3.7, 11.4.7, and 12.0.10."}],"id":"CVE-2026-123798","lastModified":"2026-11-13T13:17:58.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:32:00.758813Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:46.280","references":[{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/8d06b0cfb5409c5bf505051ddfcb94d66367caae"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/9cba541ae2ed87b878d11b257bc9b8b78341f50a"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/d0773f2a6497411aeda5d4f03d3d135a2a3ae79c"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.7"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.7"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.10"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-gvx2-mwmj-wwvj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123802.json b/data/2026/CVE-2026-123802.json
index 0c48334903..9325d04a9c 100644
--- a/data/2026/CVE-2026-123802.json
+++ b/data/2026/CVE-2026-123802.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"supertokens-core","vendor":"supertokens","versions":[{"status":"affected","version":">= 11.3.0, < 11.3.8"},{"status":"affected","version":">= 11.4.0, < 11.4.8"},{"status":"affected","version":">= 12.0.0, < 12.0.11"},{"status":"affected","version":">= 12.1.0, < 12.1.2"},{"status":"affected","version":">= 12.2.0, < 12.2.1"},{"status":"affected","version":">= 12.3.0, < 12.3.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."}],"id":"CVE-2026-123802","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T19:16:47.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-wfg2-vqfg-rqh6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-1220"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"supertokens-core","vendor":"supertokens","versions":[{"status":"affected","version":">= 11.3.0, < 11.3.8"},{"status":"affected","version":">= 11.4.0, < 11.4.8"},{"status":"affected","version":">= 12.0.0, < 12.0.11"},{"status":"affected","version":">= 12.1.0, < 12.1.2"},{"status":"affected","version":">= 12.2.0, < 12.2.1"},{"status":"affected","version":">= 12.3.0, < 12.3.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."}],"id":"CVE-2026-123802","lastModified":"2026-11-13T13:17:59.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123802","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:34:58.126841Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:47.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/00a15e045323ba8a566ca6f59b70125b4030ab6c"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/1645915320c5dfc22bce9029eb7d8364f8df402f"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/1d0fd5b40848629295cf86d47be185f92f31e445"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/324686349b21ab46fe465ca5f74294d6c68d3859"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/53f42f496477e7cc3ccd48fe57851fa08d06a248"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/5ffdd887b470035f409d61f85f2186381ad9cdd6"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/8e69a85e38709b832869c3bfc83df9a150d6f3cf"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/a2483b692d43294fdb9ad2f8f6f831cca8300081"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/b21760ceb5089b0fa30c8fd46f7bbfc680de56dd"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/c77b13061176d9bd50ed24a9cf50ffbcdf332ee5"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/commit/f4ddc022ef1ee17933efb710c21a960cb4ada083"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"},{"source":"security-advisories@github.com","url":"https://github.com/supertokens/supertokens-core/security/advisories/GHSA-wfg2-vqfg-rqh6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-345"},{"lang":"en","value":"CWE-1220"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123806.json b/data/2026/CVE-2026-123806.json
index 4522dd8131..13cbb7a406 100644
--- a/data/2026/CVE-2026-123806.json
+++ b/data/2026/CVE-2026-123806.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"python-tuf","vendor":"theupdateframework","versions":[{"status":"affected","version":"< 7.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong delegation for a requested path. Linux and macOS clients are not affected because their path normalization does not change case. This issue is fixed in 7.0.0."}],"id":"CVE-2026-123806","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:36.503","references":[{"source":"security-advisories@github.com","url":"https://github.com/theupdateframework/python-tuf/commit/8ed4414946041030b264871ac41b929cf15774a5"},{"source":"security-advisories@github.com","url":"https://github.com/theupdateframework/python-tuf/releases/tag/v7.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-qp9x-wp8f-qgjj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-178"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"python-tuf","vendor":"theupdateframework","versions":[{"status":"affected","version":"< 7.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong delegation for a requested path. Linux and macOS clients are not affected because their path normalization does not change case. This issue is fixed in 7.0.0."}],"id":"CVE-2026-123806","lastModified":"2026-11-13T13:18:00.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:09:37.342304Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:36.503","references":[{"source":"security-advisories@github.com","url":"https://github.com/theupdateframework/python-tuf/commit/8ed4414946041030b264871ac41b929cf15774a5"},{"source":"security-advisories@github.com","url":"https://github.com/theupdateframework/python-tuf/releases/tag/v7.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-qp9x-wp8f-qgjj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-178"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123811.json b/data/2026/CVE-2026-123811.json
index 0ea2ebeb34..71efb986cd 100644
--- a/data/2026/CVE-2026-123811.json
+++ b/data/2026/CVE-2026-123811.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"dynatrace-mcp","vendor":"dynatrace-oss","versions":[{"status":"affected","version":"< 2.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server's configured Dynatrace credentials. A network-reachable caller can invoke execute_dql to read logs, security events, user sessions, and other Grail data, or invoke create_dynatrace_notebook to create tenant-visible notebooks. The send_event path is not affected because its requestHumanApproval gate blocks this attack path, and reset_grail_budget only demonstrates dispatch without accessing Dynatrace data. This issue is fixed in version 2.0.0."}],"id":"CVE-2026-123811","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.3,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:37.287","references":[{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f12972481e9165e8bd24d63b0a9e71976f85a43"},{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/commit/ac5251edfcf9511c6c662414da743383e7d1451c"},{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/commit/ead820322238633f5b289778c57faf5d3a8d73f9"},{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-p7w7-4929-vpj5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"dynatrace-mcp","vendor":"dynatrace-oss","versions":[{"status":"affected","version":"< 2.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server's configured Dynatrace credentials. A network-reachable caller can invoke execute_dql to read logs, security events, user sessions, and other Grail data, or invoke create_dynatrace_notebook to create tenant-visible notebooks. The send_event path is not affected because its requestHumanApproval gate blocks this attack path, and reset_grail_budget only demonstrates dispatch without accessing Dynatrace data. This issue is fixed in version 2.0.0."}],"id":"CVE-2026-123811","lastModified":"2026-11-13T14:17:49.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.3,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123811","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:13:30.185329Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:37.287","references":[{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/commit/8f12972481e9165e8bd24d63b0a9e71976f85a43"},{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/commit/ac5251edfcf9511c6c662414da743383e7d1451c"},{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/commit/ead820322238633f5b289778c57faf5d3a8d73f9"},{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/releases/tag/v2.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-p7w7-4929-vpj5"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/dynatrace-oss/dynatrace-mcp/security/advisories/GHSA-p7w7-4929-vpj5"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123815.json b/data/2026/CVE-2026-123815.json
index 1db1a654be..9b5ca8ba3d 100644
--- a/data/2026/CVE-2026-123815.json
+++ b/data/2026/CVE-2026-123815.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"pyload","vendor":"pyload","versions":[{"status":"affected","version":"< 0.5.0b3.dev102"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102."}],"id":"CVE-2026-123815","lastModified":"2026-11-09T22:18:38.067","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:37.943","references":[{"source":"security-advisories@github.com","url":"https://github.com/pyload/pyload/commit/09eec1b431b6942a1917f094f2c77bfbf5637f60"},{"source":"security-advisories@github.com","url":"https://github.com/pyload/pyload/security/advisories/GHSA-fr26-jjhm-638c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-434"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"pyload","vendor":"pyload","versions":[{"status":"affected","version":"< 0.5.0b3.dev102"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar._safe_extractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling tarfile.extractall. On supported Python 3.9 through 3.13 runtimes, tarfile defaults to the fully_trusted extraction filter, so a user with ADD and STATUS permissions can cause extraction of a crafted archive containing character devices, block devices, or FIFOs. Python 3.14 defaults to a safe extraction filter. When pyLoad runs with operating-system privileges that permit device creation, including the official root-based Docker deployment, the archive can expose raw devices and compromise the host. Non-root deployments can still create FIFOs that cause hangs or IPC confusion. This issue is fixed in version 0.5.0b3.dev102."}],"id":"CVE-2026-123815","lastModified":"2026-11-13T14:17:49.593","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123815","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:14:21.464572Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:37.943","references":[{"source":"security-advisories@github.com","url":"https://github.com/pyload/pyload/commit/09eec1b431b6942a1917f094f2c77bfbf5637f60"},{"source":"security-advisories@github.com","url":"https://github.com/pyload/pyload/security/advisories/GHSA-fr26-jjhm-638c"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/pyload/pyload/security/advisories/GHSA-fr26-jjhm-638c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-434"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123819.json b/data/2026/CVE-2026-123819.json
index d00cbeeb61..426a74f66d 100644
--- a/data/2026/CVE-2026-123819.json
+++ b/data/2026/CVE-2026-123819.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-123819","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:38.603","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy operation reveals the contents of a snippet that the user is not authorized to view. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-123819","lastModified":"2026-11-13T14:17:49.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123819","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:15:42.525071Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:38.603","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/03ecdb63b82fa87a4932c08bc4cdd9a99339f6d4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/5afd40f0bc04f7986256ced8ec959af30e1446be"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/aebf89233c0cc9739e240e1112d705e0c995f79c"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/c06183cc9c9590e4585f27899173bc741bbbcb10"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123876.json b/data/2026/CVE-2026-123876.json
index f211dc4c7d..cfbecf6d07 100644
--- a/data/2026/CVE-2026-123876.json
+++ b/data/2026/CVE-2026-123876.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"containers-common","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"container-tools:rhel8/containers-common","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"containers-common","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"unaffected","packageName":"containers-common","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"unaffected","packageName":"skopeo","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"containers-common","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules."}],"id":"CVE-2026-123876","lastModified":"2026-11-10T20:19:03.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123876","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:57:30.881325Z","version":"2.0.3"}}]},"published":"2026-11-06T18:18:05.410","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123876"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2566536"},{"source":"secalert@redhat.com","url":"https://github.com/podman-container-tools/container-libs/issues/1248"},{"source":"secalert@redhat.com","url":"https://github.com/podman-container-tools/container-libs/pull/1249"},{"source":"secalert@redhat.com","url":"https://www.openwall.com/lists/oss-security/2026/10/27/3"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/podman-container-tools/container-libs/issues/1248"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"containers-common-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0.70.0-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"containers-common","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"container-tools:rhel8/containers-common","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"containers-common","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"unaffected","packageName":"skopeo","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"containers-common","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules."}],"id":"CVE-2026-123876","lastModified":"2026-11-13T14:17:49.877","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123876","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:57:30.881325Z","version":"2.0.3"}}]},"published":"2026-11-06T18:18:05.410","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88737"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123876"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2566536"},{"source":"secalert@redhat.com","url":"https://github.com/podman-container-tools/container-libs/issues/1248"},{"source":"secalert@redhat.com","url":"https://github.com/podman-container-tools/container-libs/pull/1249"},{"source":"secalert@redhat.com","url":"https://www.openwall.com/lists/oss-security/2026/10/27/3"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/podman-container-tools/container-libs/issues/1248"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124625.json b/data/2026/CVE-2026-124625.json
index e3078846b8..5d9e050cdf 100644
--- a/data/2026/CVE-2026-124625.json
+++ b/data/2026/CVE-2026-124625.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:piprapay:piprapay:*:*:*:*:*:*:*:*"],"modules":["Admin Panel"],"product":"PipraPay","vendor":"n/a","versions":[{"status":"affected","version":"3.0.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"id":"CVE-2026-124625","lastModified":"2026-11-09T14:17:16.420","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T14:17:16.257","references":[{"source":"cna@vuldb.com","url":"https://github.com/PipraPay/PipraPay/"},{"source":"cna@vuldb.com","url":"https://github.com/PipraPay/PipraPay/issues/70"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124625"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040556"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433050"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433050/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}],"source":"cna@vuldb.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:piprapay:piprapay:*:*:*:*:*:*:*:*"],"modules":["Admin Panel"],"product":"PipraPay","vendor":"n/a","versions":[{"status":"affected","version":"3.0.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"id":"CVE-2026-124625","lastModified":"2026-11-13T13:18:01.900","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124625","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:08:04.732631Z","version":"2.0.3"}}]},"published":"2026-11-09T14:17:16.257","references":[{"source":"cna@vuldb.com","url":"https://github.com/PipraPay/PipraPay/"},{"source":"cna@vuldb.com","url":"https://github.com/PipraPay/PipraPay/issues/70"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124625"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040556"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433050"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433050/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124742.json b/data/2026/CVE-2026-124742.json
index 3c40cf6ef9..ab1977dfde 100644
--- a/data/2026/CVE-2026-124742.json
+++ b/data/2026/CVE-2026-124742.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations."}],"id":"CVE-2026-124742","lastModified":"2026-11-11T12:19:47.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T12:19:47.867","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124742"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571620"},{"source":"secalert@redhat.com","url":"https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"secalert@redhat.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.37.0-9.5.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. The volume identification component fails to properly validate cluster parameters when analyzing specially formatted FAT filesystems. An attacker able to present a crafted storage device or disk image can trigger a divide-by-zero condition when partition scanning utilities inspect the volume. This issue causes the probing utilities to crash unexpectedly, resulting in a Denial of Service (DoS) that can disrupt device discovery and system boot operations."}],"id":"CVE-2026-124742","lastModified":"2026-11-13T14:17:50.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T12:19:47.867","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99577"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124742"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571620"},{"source":"secalert@redhat.com","url":"https://github.com/vda-linux/busybox_mirror/commit/b7c89c4"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124758.json b/data/2026/CVE-2026-124758.json
new file mode 100644
index 0000000000..f0ff443e3a
--- /dev/null
+++ b/data/2026/CVE-2026-124758.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access."}],"id":"CVE-2026-124758","lastModified":"2026-11-13T14:17:50.293","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:50.183","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124759.json b/data/2026/CVE-2026-124759.json
new file mode 100644
index 0000000000..03623d9e68
--- /dev/null
+++ b/data/2026/CVE-2026-124759.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"},{"lessThan":"*","status":"affected","version":"1.0.4","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 routes a received RTA alarm frame to an Application Relationship using only the destination alarm reference in the frame, without checking the source of the frame. A host with ADJACENT network access can abort an established Application Relationship with a single alarm ERROR frame, or deliver forged alarm notifications with chosen type, slot, subslot, USI and payload to the application."}],"id":"CVE-2026-124759","lastModified":"2026-11-13T14:17:50.433","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:50.337","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124760.json b/data/2026/CVE-2026-124760.json
new file mode 100644
index 0000000000..5efa2f5b0c
--- /dev/null
+++ b/data/2026/CVE-2026-124760.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 sets the alarm receiver state to waiting for confirmation before the data of a received alarm notification is parsed. If the parsing fails the state is not restored, and later alarm notifications of the same priority are discarded without acknowledge until the Application Relationship is released. The Application Relationship and the cyclic data exchange keep working. The attacker must be able to send an alarm notification in the context of an established Application Relationship and requires ADJACENT network access."}],"id":"CVE-2026-124760","lastModified":"2026-11-13T14:17:50.573","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:50.480","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124761.json b/data/2026/CVE-2026-124761.json
new file mode 100644
index 0000000000..7c11fa854c
--- /dev/null
+++ b/data/2026/CVE-2026-124761.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and starts saving it, before the state of the device is checked. If the request is refused, for example because an Application Relationship is active, the configuration is not restored and is still saved. After a restart the device uses the refused address, and may not answer the controller or may use its address. A host with ADJACENT network access can use this while an Application Relationship is active."}],"id":"CVE-2026-124761","lastModified":"2026-11-13T14:17:50.710","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:50.613","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124762.json b/data/2026/CVE-2026-124762.json
new file mode 100644
index 0000000000..1da4c7543d
--- /dev/null
+++ b/data/2026/CVE-2026-124762.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"},{"lessThan":"*","status":"affected","version":"1.0.4","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU for the session aborts the Application Relationship, without checking that the PDU is the answer to a call of the device or where it comes from. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can abort the Application Relationship with one PDU. It also allocates a session for an unknown activity UUID and changes the address stored for an existing session."}],"id":"CVE-2026-124762","lastModified":"2026-11-13T14:17:50.853","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:50.753","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124854.json b/data/2026/CVE-2026-124854.json
index 4192e076ea..5887c065f2 100644
--- a/data/2026/CVE-2026-124854.json
+++ b/data/2026/CVE-2026-124854.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124854","lastModified":"2026-11-13T05:18:17.837","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124854","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T14:17:17.170","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2060230"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred"}
+{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124854","lastModified":"2026-11-13T14:17:50.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124854","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:52.937831Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:17.170","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2060230"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124951.json b/data/2026/CVE-2026-124951.json
index b788e0b460..3b31e54c15 100644
--- a/data/2026/CVE-2026-124951.json
+++ b/data/2026/CVE-2026-124951.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124951","lastModified":"2026-11-13T05:18:19.327","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124951","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T14:17:29.480","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2085124"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred"}
+{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.7","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"160","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}],"id":"CVE-2026-124951","lastModified":"2026-11-13T14:17:51.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124951","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:39.949531Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:29.480","references":[{"source":"security@mozilla.org","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2085124"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-125/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-127/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-128/"},{"source":"security@mozilla.org","url":"https://www.mozilla.org/security/advisories/mfsa2026-129/"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124987.json b/data/2026/CVE-2026-124987.json
index 00b7830f90..77b0928fdc 100644
--- a/data/2026/CVE-2026-124987.json
+++ b/data/2026/CVE-2026-124987.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:mikefarah:yq:*:*:*:*:*:*:*:*"],"product":"yq","vendor":"mikefarah","versions":[{"status":"affected","version":"4.53.0"},{"status":"affected","version":"4.53.1"},{"status":"affected","version":"4.53.2"},{"status":"affected","version":"4.53.3"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance."}],"id":"CVE-2026-124987","lastModified":"2026-11-09T20:18:11.080","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T20:18:10.927","references":[{"source":"cna@vuldb.com","url":"https://github.com/mikefarah/yq/"},{"source":"cna@vuldb.com","url":"https://github.com/mikefarah/yq/issues/2901"},{"source":"cna@vuldb.com","url":"https://github.com/mikefarah/yq/pull/2902"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124987"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040562"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433161"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433161/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-116"}],"source":"cna@vuldb.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:mikefarah:yq:*:*:*:*:*:*:*:*"],"product":"yq","vendor":"mikefarah","versions":[{"status":"affected","version":"4.53.0"},{"status":"affected","version":"4.53.1"},{"status":"affected","version":"4.53.2"},{"status":"affected","version":"4.53.3"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance."}],"id":"CVE-2026-124987","lastModified":"2026-11-13T13:18:02.917","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124987","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:07:47.641186Z","version":"2.0.3"}}]},"published":"2026-11-09T20:18:10.927","references":[{"source":"cna@vuldb.com","url":"https://github.com/mikefarah/yq/"},{"source":"cna@vuldb.com","url":"https://github.com/mikefarah/yq/issues/2901"},{"source":"cna@vuldb.com","url":"https://github.com/mikefarah/yq/pull/2902"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124987"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040562"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433161"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433161/cti"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://vuldb.com/submit/1040562"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-116"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124999.json b/data/2026/CVE-2026-124999.json
index 2c2a9394b9..a8798aefd2 100644
--- a/data/2026/CVE-2026-124999.json
+++ b/data/2026/CVE-2026-124999.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:braindecode:braindecode:*:*:*:*:*:*:*:*"],"modules":["Hub Integration"],"product":"braindecode","vendor":"n/a","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"affected","version":"1.8.2"},{"status":"unaffected","version":"2.0.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_pretrained of the file braindecode/models/base.py of the component Hub Integration. Such manipulation of the argument filename leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.0.0 mitigates this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. It is recommended to upgrade the affected component."}],"id":"CVE-2026-124999","lastModified":"2026-11-09T22:18:40.040","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-09T22:18:39.883","references":[{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/issues/1440"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/pull/1494"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/releases/tag/v2.0.0"},{"source":"cna@vuldb.com","url":"https://github.com/user-attachments/files/33599273/poc.zip"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124999"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040628"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433167"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433167/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cna@vuldb.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:braindecode:braindecode:*:*:*:*:*:*:*:*"],"modules":["Hub Integration"],"product":"braindecode","vendor":"n/a","versions":[{"status":"affected","version":"1.8.0"},{"status":"affected","version":"1.8.1"},{"status":"affected","version":"1.8.2"},{"status":"unaffected","version":"2.0.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_pretrained of the file braindecode/models/base.py of the component Hub Integration. Such manipulation of the argument filename leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.0.0 mitigates this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. It is recommended to upgrade the affected component."}],"id":"CVE-2026-124999","lastModified":"2026-11-13T14:17:51.367","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124999","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:24:12.953005Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:39.883","references":[{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/commit/05b764d93b9a50400f523206fbe03d73d0cf5edb"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/issues/1440"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/pull/1494"},{"source":"cna@vuldb.com","url":"https://github.com/braindecode/braindecode/releases/tag/v2.0.0"},{"source":"cna@vuldb.com","url":"https://github.com/user-attachments/files/33599273/poc.zip"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-124999"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1040628"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433167"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/433167/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125097.json b/data/2026/CVE-2026-125097.json
index d516455685..1865665c06 100644
--- a/data/2026/CVE-2026-125097.json
+++ b/data/2026/CVE-2026-125097.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output."}],"id":"CVE-2026-125097","lastModified":"2026-11-10T21:46:30.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:50.580","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/rawdec.c#L208"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/01a395b935b9da12dbeca588a7130c4db6a14689"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-rawdec-c-raw-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in raw_decode() in libavcodec/rawdec.c that fails to verify packet stride covers a full row for 1 to 8 bits per pixel video. Attackers can supply crafted AVI, MOV or NUT files with truncated low bit depth rawvideo packets to leak uninitialized heap memory through decoded frame output."}],"id":"CVE-2026-125097","lastModified":"2026-11-13T13:18:03.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125097","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:41:14.186810Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:50.580","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25715"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/rawdec.c#L208"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/01a395b935b9da12dbeca588a7130c4db6a14689"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-heap-memory-disclosure-via-rawdec-c-raw-video-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125101.json b/data/2026/CVE-2026-125101.json
index c924fae605..ca9408da50 100644
--- a/data/2026/CVE-2026-125101.json
+++ b/data/2026/CVE-2026-125101.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output."}],"id":"CVE-2026-125101","lastModified":"2026-11-10T21:46:33.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:51.177","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vmnc.c#L348"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/50865f20b1f474e6b11735c88f668751bc9aa528"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vmnc-decoder-uninitialized-heap-memory-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in the VMnc decoder in libavcodec/vmnc.c that restores an unwritten cursor save area into later frames. Attackers can supply a crafted VMnc stream where a frame fails after loading a cursor shape, causing uninitialized heap bytes from screendta to appear in decoded output."}],"id":"CVE-2026-125101","lastModified":"2026-11-13T13:18:05.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125101","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:42:42.178920Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.177","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vmnc.c#L348"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/50865f20b1f474e6b11735c88f668751bc9aa528"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-vmnc-decoder-uninitialized-heap-memory-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125106.json b/data/2026/CVE-2026-125106.json
index 68fdd6e40b..d932fbe7d2 100644
--- a/data/2026/CVE-2026-125106.json
+++ b/data/2026/CVE-2026-125106.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-125106","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:41.660","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/1fcf3ce3dbd6cfd54980a28fd61bd1de03ce819d"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/344ef54f6c2fa8c03921125ee46697d319fdc652"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/3c28e5ac3b1cd12eeb9a3a23e0949e7786305b2e"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/ac853cfb575ccd6868e7454f26064b8f3daabd4a"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"wagtail","vendor":"wagtail","versions":[{"status":"affected","version":"< 7.0.9"},{"status":"affected","version":">= 7.1, < 7.3.4"},{"status":"affected","version":">= 7.4, < 7.4.3"},{"status":"affected","version":"= 8.0rc1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the inaccessible page into a translation, allowing the user to view its contents despite the missing source-page edit permission. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2."}],"id":"CVE-2026-125106","lastModified":"2026-11-13T14:17:51.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125106","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:16:36.567252Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:41.660","references":[{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/1fcf3ce3dbd6cfd54980a28fd61bd1de03ce819d"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/344ef54f6c2fa8c03921125ee46697d319fdc652"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/3c28e5ac3b1cd12eeb9a3a23e0949e7786305b2e"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/commit/ac853cfb575ccd6868e7454f26064b8f3daabd4a"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.3.4"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v7.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/releases/tag/v8.0rc2"},{"source":"security-advisories@github.com","url":"https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-280"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125108.json b/data/2026/CVE-2026-125108.json
index 951f9b10ab..5dffc23dd2 100644
--- a/data/2026/CVE-2026-125108.json
+++ b/data/2026/CVE-2026-125108.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}],"id":"CVE-2026-125108","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:41.963","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v2.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.1.23"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.2.8"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}],"id":"CVE-2026-125108","lastModified":"2026-11-13T14:17:51.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125108","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:22:10.976638Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:41.963","references":[{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v2.2.25"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.1.23"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/releases/tag/v3.2.8"},{"source":"security-advisories@github.com","url":"https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125112.json b/data/2026/CVE-2026-125112.json
index 98437da0d0..94a20d2ad3 100644
--- a/data/2026/CVE-2026-125112.json
+++ b/data/2026/CVE-2026-125112.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"djust","vendor":"djust-org","versions":[{"status":"affected","version":"< 1.0.10"},{"status":"affected","version":">= 1.1.0, < 1.1.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2."}],"id":"CVE-2026-125112","lastModified":"2026-11-09T22:18:42.717","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:42.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/commit/06d213dbdd82f5b1c2affe2f869ae88a71809e4a"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/commit/5288e5dbc8d83d8aee8a22a0a7a3a478461c8965"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/pull/2444"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/releases/tag/v1.0.10"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/releases/tag/v1.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/security/advisories/GHSA-xjw9-38cr-6372"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"djust","vendor":"djust-org","versions":[{"status":"affected","version":"< 1.0.10"},{"status":"affected","version":">= 1.1.0, < 1.1.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to versions 1.0.10 and 1.1.2, djust keys context output-safety grants by variable name and fails to revoke a grant when a template bind replaces the value associated with that name. A template using {% with %}, {% for %}, {% include ... with %}, tuple unpacking, or assign tags can therefore rebind a name that previously held mark_safe content and emit the new attacker-controlled value without escaping, including descendant lookups through the rebound name. This can cause stored or reflected cross-site scripting when a victim renders the affected template. This issue is fixed in versions 1.0.10 and 1.1.2."}],"id":"CVE-2026-125112","lastModified":"2026-11-13T14:17:52.223","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:30:15.854888Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:42.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/commit/06d213dbdd82f5b1c2affe2f869ae88a71809e4a"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/commit/5288e5dbc8d83d8aee8a22a0a7a3a478461c8965"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/pull/2444"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/releases/tag/v1.0.10"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/releases/tag/v1.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/djust-org/djust/security/advisories/GHSA-xjw9-38cr-6372"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125116.json b/data/2026/CVE-2026-125116.json
index 3e1b661d74..86b22a2a1f 100644
--- a/data/2026/CVE-2026-125116.json
+++ b/data/2026/CVE-2026-125116.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125116","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:21.907","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.12"},{"status":"affected","version":">= 7.0.0, < 7.8.13"},{"status":"affected","version":">= 8.0.0, < 8.24.7"},{"status":"affected","version":">= 9.0.0, < 9.11.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object registries such as Model.discriminators and schema.discriminators without requiring an own property. Values such as constructor, toString, or hasOwnProperty can therefore resolve to inherited built-in functions instead of a registered discriminator, causing type confusion in model construction, document creation, hydration, query and update casting, embedded discriminators, and populate operations. In the bulkWrite() insertOne path with skipValidation enabled, a constructor value can cause a raw input object to be stored without schema casting or strict filtering, and a stored poisoned document can make every query that hydrates it fail until the document is removed. The weakness reads inherited properties but does not modify Object.prototype and is not prototype pollution. This issue is fixed in versions 6.13.12, 7.8.13, 8.24.7, and 9.11.4."}],"id":"CVE-2026-125116","lastModified":"2026-11-13T14:17:52.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125116","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:36:48.655399Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:21.907","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/0ecd8040d9b446f36535d79938c130c800f91766"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/18afab75bea861f625b7c5b54635c84567ec566c"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/390453c8ce1b36b6cfd1e63432a910da1f3d81d5"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8cee51beead554df1f3d05645edb439c69eb2a9b"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b26c43554233134ea978c5852babe13be858b2cf"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b68f90734b50cd22c89a669c8ca1469d7234b296"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.13"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.7"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.11.4"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-wr5m-5jph-8m96"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125120.json b/data/2026/CVE-2026-125120.json
index 0cbb8fab26..7260cf0336 100644
--- a/data/2026/CVE-2026-125120.json
+++ b/data/2026/CVE-2026-125120.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.11"},{"status":"affected","version":">= 7.0.0, < 7.8.12"},{"status":"affected","version":">= 8.0.0, < 8.24.3"},{"status":"affected","version":">= 9.0.0, < 9.9.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2."}],"id":"CVE-2026-125120","lastModified":"2026-11-12T19:18:09.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T23:17:22.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.11"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.3"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.9.2"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"mongoose","vendor":"Automattic","versions":[{"status":"affected","version":"< 6.13.11"},{"status":"affected","version":">= 7.0.0, < 7.8.12"},{"status":"affected","version":">= 8.0.0, < 8.24.3"},{"status":"affected","version":">= 9.0.0, < 9.9.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.11, 7.8.12, 8.24.3, and 9.9.2, Mongoose countDocuments() does not apply the configured sanitizeFilter query selector injection defense. An application that enables sanitizeFilter and passes attacker-controlled filter values to countDocuments() can therefore process query operator objects as operators rather than literal values, causing the count to include documents that should not match and potentially undermining authorization or application logic based on that count. This issue is fixed in versions 6.13.11, 7.8.12, 8.24.3, and 9.9.2."}],"id":"CVE-2026-125120","lastModified":"2026-11-13T14:17:52.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:38:54.842323Z","version":"2.0.3"}}]},"published":"2026-11-09T23:17:22.587","references":[{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/7e912af3fac52cb0eea4cd71e24d65318916831a"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/8b10d5760bb181f5bf5d01495cde161c8aed0557"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b1df045aab076b740fdaec14a15a44c694b85b7d"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/commit/b5003d3915db1cf9209c38a4b93cf3a92cddd710"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/6.13.11"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/7.8.12"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/8.24.3"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/releases/tag/9.9.2"},{"source":"security-advisories@github.com","url":"https://github.com/Automattic/mongoose/security/advisories/GHSA-pcrw-h46h-c93h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-943"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125170.json b/data/2026/CVE-2026-125170.json
index 70a9353a22..a36efbca18 100644
--- a/data/2026/CVE-2026-125170.json
+++ b/data/2026/CVE-2026-125170.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized stack bytes."}],"id":"CVE-2026-125170","lastModified":"2026-11-10T21:46:41.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:51.773","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24597"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/targa.c#L72"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f8f84348dfe1a80d38e7dbbcddcdd5d92a760dfd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-targa-decode-rle"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in targa_decode_rle() in libavcodec/targa.c caused by missing packet length checks. Attackers can supply truncated RLE-compressed TGA images so decoded frames contain leftover heap buffer data and replicated uninitialized stack bytes."}],"id":"CVE-2026-125170","lastModified":"2026-11-13T13:18:06.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125170","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:44:35.291503Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:51.773","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24597"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/targa.c#L72"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/f8f84348dfe1a80d38e7dbbcddcdd5d92a760dfd"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-memory-disclosure-via-targa-decode-rle"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125178.json b/data/2026/CVE-2026-125178.json
index 239f45e268..cc639e7592 100644
--- a/data/2026/CVE-2026-125178.json
+++ b/data/2026/CVE-2026-125178.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames."}],"id":"CVE-2026-125178","lastModified":"2026-11-10T21:46:25.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:52.973","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tdsc.c#L207"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/12c589a37d093cc55618f8377b092dc21416806f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-heap-read-via-tdsc-cursor-dimensions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability in tdsc_load_cursor() in libavcodec/tdsc.c, which stores cursor dimensions before validating them. Attackers can supply a crafted AVI file with oversized TDSC cursor dimensions so tdsc_paint_cursor() reads past the cursor buffer, crashing the decoder or leaking heap memory into frames."}],"id":"CVE-2026-125178","lastModified":"2026-11-13T13:18:07.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:45:50.456037Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:52.973","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24682"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/tdsc.c#L207"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/12c589a37d093cc55618f8377b092dc21416806f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-heap-read-via-tdsc-cursor-dimensions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125182.json b/data/2026/CVE-2026-125182.json
index 0189ac1d26..96b0240ba4 100644
--- a/data/2026/CVE-2026-125182.json
+++ b/data/2026/CVE-2026-125182.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR."}],"id":"CVE-2026-125182","lastModified":"2026-11-10T21:46:30.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:53.587","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cook.c#L854"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/7145d13201c9f9c5253f40295714faa4f4ada1a0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-cook-decoder-js-subband-start"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Cook decoder joint_decode() function because cook_decode_init() does not check js_subband_start against subbands. Attackers can supply a crafted RealMedia file whose extradata causes reads past decode_buffer_0, leaking pointers and decoder state into decoded audio to help defeat ASLR."}],"id":"CVE-2026-125182","lastModified":"2026-11-13T13:18:08.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:48:19.971028Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:53.587","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24763"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/cook.c#L854"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/7145d13201c9f9c5253f40295714faa4f4ada1a0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-cook-decoder-js-subband-start"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125190.json b/data/2026/CVE-2026-125190.json
index 1fdf25002a..dcc5bb4892 100644
--- a/data/2026/CVE-2026-125190.json
+++ b/data/2026/CVE-2026-125190.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames."}],"id":"CVE-2026-125190","lastModified":"2026-11-10T21:46:41.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:54.777","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25278"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mvcdec.c#L141"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/3a5eb948e76dc6390e4b3cff7becf84bc492b7af"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-stack-memory-disclosure-via-mvc2-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an information disclosure vulnerability in decode_mvc2() in libavcodec/mvcdec.c that leaks uninitialized stack memory through unchecked palette indices. Attackers can supply a crafted MVC2 stream declaring few colors but referencing higher palette indices, copying process stack contents into decoded RGB frames."}],"id":"CVE-2026-125190","lastModified":"2026-11-13T13:18:09.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125190","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:49:11.107692Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:54.777","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25278"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mvcdec.c#L141"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/3a5eb948e76dc6390e4b3cff7becf84bc492b7af"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-stack-memory-disclosure-via-mvc2-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125198.json b/data/2026/CVE-2026-125198.json
index 5a92458c20..56f2244017 100644
--- a/data/2026/CVE-2026-125198.json
+++ b/data/2026/CVE-2026-125198.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion."}],"id":"CVE-2026-125198","lastModified":"2026-11-10T21:46:30.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:55.977","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22550"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mediacodec_wrapper.c#L1134"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaformat_jni_setBuffer() in libavcodec/mediacodec_wrapper.c that never frees buffers wrapped with NewDirectByteBuffer(). Attackers can supply crafted media files with large extradata, leaking native memory on each MediaCodec decoder configuration in Android applications and causing resource exhaustion."}],"id":"CVE-2026-125198","lastModified":"2026-11-13T13:18:10.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125198","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:49:58.228422Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:55.977","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22550"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/mediacodec_wrapper.c#L1134"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/e5d295b3cd467fc713300e208ba2dacc7ff603a0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-memory-leak-via-mediacodec-jni-setbuffer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125202.json b/data/2026/CVE-2026-125202.json
index 6aade942a7..0e51fc8f4b 100644
--- a/data/2026/CVE-2026-125202.json
+++ b/data/2026/CVE-2026-125202.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI."}],"id":"CVE-2026-125202","lastModified":"2026-11-10T21:46:26.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:56.583","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vaapi_hevc.c#L221"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vaapi-tile-arrays"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi_hevc_start_frame() in libavcodec/vaapi_hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values past heap-allocated hwaccel data, corrupting memory in applications decoding with VAAPI."}],"id":"CVE-2026-125202","lastModified":"2026-11-13T13:18:11.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125202","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:51:13.680872Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:56.583","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25136"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/vaapi_hevc.c#L221"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hevc-vaapi-tile-arrays"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125206.json b/data/2026/CVE-2026-125206.json
index 1ca1c1a0d0..04fc2c8ed9 100644
--- a/data/2026/CVE-2026-125206.json
+++ b/data/2026/CVE-2026-125206.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlaced ProRes 4444, causing out-of-bounds memory to be encoded into the output alpha plane."}],"id":"CVE-2026-125206","lastModified":"2026-11-10T21:46:30.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:57.193","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24490"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/proresenc_kostya.c#L150"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/9edd06f8612c242b83bf9e3d14aa85180015a211"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-prores-ks-interlaced-alpha-encoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-127"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the prores_ks encoder's get_alpha_data() that reads before the blocks buffer for interlaced frames with odd heights. Attackers can supply video with alpha and odd height encoded to interlaced ProRes 4444, causing out-of-bounds memory to be encoded into the output alpha plane."}],"id":"CVE-2026-125206","lastModified":"2026-11-13T13:18:12.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125206","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:52:10.335319Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:57.193","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24490"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/proresenc_kostya.c#L150"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/9edd06f8612c242b83bf9e3d14aa85180015a211"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-read-via-prores-ks-interlaced-alpha-encoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-127"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125210.json b/data/2026/CVE-2026-125210.json
index f10a212171..05418e0258 100644
--- a/data/2026/CVE-2026-125210.json
+++ b/data/2026/CVE-2026-125210.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and corrupting heap memory."}],"id":"CVE-2026-125210","lastModified":"2026-11-10T21:46:26.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:57.793","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24992"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libaribcaption.c#L799"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/7c06aea6f0d26dd70c94ccba6127059cd0a0e352"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-in-libaribcaption-text-subtitle-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-131"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in aribcaption_trans_text_subtitle() in libavcodec/libaribcaption.c when decoding with sub_type text. Attackers can supply a crafted ARIB STD-B24 caption stream with zero regions, causing a pointer write past a zero-sized sub->rects allocation and corrupting heap memory."}],"id":"CVE-2026-125210","lastModified":"2026-11-13T13:18:13.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125210","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:56:08.496327Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:57.793","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24992"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/libaribcaption.c#L799"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/7c06aea6f0d26dd70c94ccba6127059cd0a0e352"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-overflow-in-libaribcaption-text-subtitle-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-131"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125214.json b/data/2026/CVE-2026-125214.json
index 71c2ede780..e0e554794b 100644
--- a/data/2026/CVE-2026-125214.json
+++ b/data/2026/CVE-2026-125214.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer."}],"id":"CVE-2026-125214","lastModified":"2026-11-10T21:46:42.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:58.433","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25337"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcm-bluray.c#L170"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/a61b32df3fd67f76c1c8c7ea51be2a66efb0f945"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-in-blu-ray-pcm-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in pcm_bluray_decode_frame() in libavcodec/pcm-bluray.c on big-endian hosts. Attackers can supply a crafted Blu-ray (M2TS) LPCM stream whose payload length is not a multiple of the sample size, writing attacker-controlled bytes past the audio frame buffer."}],"id":"CVE-2026-125214","lastModified":"2026-11-13T14:17:52.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125214","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T14:11:24.456451Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:58.433","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25337"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pcm-bluray.c#L170"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/a61b32df3fd67f76c1c8c7ea51be2a66efb0f945"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-in-blu-ray-pcm-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125218.json b/data/2026/CVE-2026-125218.json
index 13be8d64c5..6799f629a3 100644
--- a/data/2026/CVE-2026-125218.json
+++ b/data/2026/CVE-2026-125218.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encode_apng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG_DISPOSE_OP_BACKGROUND memset writes past prev_frame and crashing or corrupting heap memory in transcoding applications."}],"id":"CVE-2026-125218","lastModified":"2026-11-10T21:46:26.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:59.043","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pngenc.c#L1148"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b7e1e57035b95498b42f54a6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-apng-encoder-heap-buffer-overflow-via-encode-apng"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the APNG encoder's encode_apng() function in libavcodec/pngenc.c when frame size changes mid-stream. Attackers can supply crafted media whose resolution grows mid-stream, causing APNG_DISPOSE_OP_BACKGROUND memset writes past prev_frame and crashing or corrupting heap memory in transcoding applications."}],"id":"CVE-2026-125218","lastModified":"2026-11-13T13:18:14.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125218","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:58:09.950771Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:59.043","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25682"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/pngenc.c#L1148"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/9b99973b2bbecee0b7e1e57035b95498b42f54a6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-apng-encoder-heap-buffer-overflow-via-encode-apng"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125222.json b/data/2026/CVE-2026-125222.json
index 360832daea..14113eb06f 100644
--- a/data/2026/CVE-2026-125222.json
+++ b/data/2026/CVE-2026-125222.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code."}],"id":"CVE-2026-125222","lastModified":"2026-11-10T21:46:30.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:16:59.640","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25702"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hapdec.c#L215"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/62c308e0416bb701447817fe6f0bff074d206215"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hap-parse-frame-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code."}],"id":"CVE-2026-125222","lastModified":"2026-11-13T13:18:15.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125222","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:59:49.973837Z","version":"2.0.3"}}]},"published":"2026-11-09T19:16:59.640","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25702"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/hapdec.c#L215"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/62c308e0416bb701447817fe6f0bff074d206215"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hap-parse-frame-header"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125250.json b/data/2026/CVE-2026-125250.json
index 9fdff44f77..036e66b135 100644
--- a/data/2026/CVE-2026-125250.json
+++ b/data/2026/CVE-2026-125250.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding."}],"id":"CVE-2026-125250","lastModified":"2026-11-10T21:46:26.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:17:03.883","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/gif.c#L405"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/26c2980980295e5516f308c5a2792d2a72e43eae"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-gif-encoder-heap-buffer-overflow-via-shrunk-buf-remap"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encoder's gif_image_write_image() in libavcodec/gif.c because shrunk_buf is sized from the first frame's linesize. Attackers can supply PAL8 video whose frame linesize grows mid-stream, causing remap_frame_to_palette() to write past shrunk_buf and corrupt the heap during GIF transcoding."}],"id":"CVE-2026-125250","lastModified":"2026-11-13T13:18:16.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125250","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:01:25.891447Z","version":"2.0.3"}}]},"published":"2026-11-09T19:17:03.883","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25690"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/gif.c#L405"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/26c2980980295e5516f308c5a2792d2a72e43eae"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-gif-encoder-heap-buffer-overflow-via-shrunk-buf-remap"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125262.json b/data/2026/CVE-2026-125262.json
index 271bf1f8c4..c1211da8d3 100644
--- a/data/2026/CVE-2026-125262.json
+++ b/data/2026/CVE-2026-125262.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"7.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications."}],"id":"CVE-2026-125262","lastModified":"2026-11-10T21:46:30.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T20:18:12.657","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/lcevcdec.c#L224"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613a48665dcb8d14186b33dad90aa40ae0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"7.1","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or HEVC streams to corrupt heap memory in decoding applications."}],"id":"CVE-2026-125262","lastModified":"2026-11-13T13:18:17.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:03:56.587861Z","version":"2.0.3"}}]},"published":"2026-11-09T20:18:12.657","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25067"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/lcevcdec.c#L224"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/fd6dfa613a48665dcb8d14186b33dad90aa40ae0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-lcevc-enhancement-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125266.json b/data/2026/CVE-2026-125266.json
index 62604e3ac5..a230eaaa52 100644
--- a/data/2026/CVE-2026-125266.json
+++ b/data/2026/CVE-2026-125266.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video."}],"id":"CVE-2026-125266","lastModified":"2026-11-10T21:46:26.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T20:18:13.233","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sanm.c#L799"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/d42cb1925987cc27899441ce39fa7bd2647dc72e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-stack-memory-disclosure-via-sanm-codec-23"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"8.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in old_codec23() of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack memory in output video."}],"id":"CVE-2026-125266","lastModified":"2026-11-13T13:18:19.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:04:56.423362Z","version":"2.0.3"}}]},"published":"2026-11-09T20:18:13.233","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25718"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/sanm.c#L799"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/d42cb1925987cc27899441ce39fa7bd2647dc72e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-uninitialized-stack-memory-disclosure-via-sanm-codec-23"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125270.json b/data/2026/CVE-2026-125270.json
index 80fe0fa8e4..63e5176b01 100644
--- a/data/2026/CVE-2026-125270.json
+++ b/data/2026/CVE-2026-125270.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output."}],"id":"CVE-2026-125270","lastModified":"2026-11-10T21:46:30.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T20:18:13.843","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24328"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.c#L410"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/b8f159858e2fd29dae4fa34d9e713bbf9bbf190e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-out-of-bounds-read-in-v4l2-m2m-encoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/ffmpeg/ffmpeg","product":"FFmpeg","repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg","vendor":"FFmpeg","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or leaking heap memory into encoded output."}],"id":"CVE-2026-125270","lastModified":"2026-11-13T13:18:20.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125270","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:06:34.484660Z","version":"2.0.3"}}]},"published":"2026-11-09T20:18:13.843","references":[{"source":"disclosure@vulncheck.com","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24328"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/v4l2_buffers.c#L410"},{"source":"disclosure@vulncheck.com","url":"https://github.com/FFmpeg/FFmpeg/commit/b8f159858e2fd29dae4fa34d9e713bbf9bbf190e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-out-of-bounds-read-in-v4l2-m2m-encoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125358.json b/data/2026/CVE-2026-125358.json
index a7c5292353..65879f466f 100644
--- a/data/2026/CVE-2026-125358.json
+++ b/data/2026/CVE-2026-125358.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"universal-modder","repo":"https://github.com/rehan-remade/universal-modder","vendor":"rehan-remade","versions":[{"lessThan":"e88f6876745427321eb755ebc98276063a962d8a","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority."}],"id":"CVE-2026-125358","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:07.180","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1385"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"universal-modder","repo":"https://github.com/rehan-remade/universal-modder","vendor":"rehan-remade","versions":[{"lessThan":"e88f6876745427321eb755ebc98276063a962d8a","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority."}],"id":"CVE-2026-125358","lastModified":"2026-11-13T14:17:52.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125358","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:42:39.044986Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:07.180","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rehan-remade/universal-modder/blob/edf45f6a26cb047886d9d7bcba392c328fc3d317/examples/minecraft-gta5-passthrough/mc/src/client/java/dev/rehan/passthrough/client/HostLink.java#L54-L72"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rehan-remade/universal-modder/commit/e88f6876745427321eb755ebc98276063a962d8a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/universal-modder-before-e88f687-cross-site-websocket-command-execution-via-hostlink"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/rehan-remade/universal-modder/security/advisories/GHSA-wjf6-3h6v-4gq9"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1385"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125362.json b/data/2026/CVE-2026-125362.json
index 340da40948..102cc23522 100644
--- a/data/2026/CVE-2026-125362.json
+++ b/data/2026/CVE-2026-125362.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"seahub","vendor":"haiwen","versions":[{"lessThanOrEqual":"14.0.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords."}],"id":"CVE-2026-125362","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:07.877","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seahub"},{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seahub/blob/v14.0.10-pro/seahub/api2/endpoints/multi_share_links.py#L502-L512"},{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seahub/issues/9687"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"seahub","vendor":"haiwen","versions":[{"lessThanOrEqual":"14.0.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords."}],"id":"CVE-2026-125362","lastModified":"2026-11-13T14:17:52.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125362","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:46:20.120732Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:07.877","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seahub"},{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seahub/blob/v14.0.10-pro/seahub/api2/endpoints/multi_share_links.py#L502-L512"},{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seahub/commit/dd3ba0341031fd29cabe4855b548badde861df52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seahub/issues/9687"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/seahub-through-14.0.10-predictable-share-link-passwords-via-batch-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-338"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125366.json b/data/2026/CVE-2026-125366.json
index 2c886e9360..eaa18b9134 100644
--- a/data/2026/CVE-2026-125366.json
+++ b/data/2026/CVE-2026-125366.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/asciimoo/omnom","product":"omnom","vendor":"asciimoo","versions":[{"lessThanOrEqual":"0.9.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports."}],"id":"CVE-2026-125366","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:08.577","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/asciimoo/omnom"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asciimoo/omnom/blob/v0.9.0/feed/feed.go#L421"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asciimoo/omnom/commit/01c45510ab06c51bc952901514735b457a492f10"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asciimoo/omnom/issues/67"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnom-through-0.9.0-ssrf-via-add-feed-add-feed-route"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/asciimoo/omnom","product":"omnom","vendor":"asciimoo","versions":[{"lessThanOrEqual":"0.9.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports."}],"id":"CVE-2026-125366","lastModified":"2026-11-13T14:17:53.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125366","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:48:32.241677Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:08.577","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/asciimoo/omnom"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asciimoo/omnom/blob/v0.9.0/feed/feed.go#L421"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asciimoo/omnom/commit/01c45510ab06c51bc952901514735b457a492f10"},{"source":"disclosure@vulncheck.com","url":"https://github.com/asciimoo/omnom/issues/67"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnom-through-0.9.0-ssrf-via-add-feed-add-feed-route"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125370.json b/data/2026/CVE-2026-125370.json
index cd0f4c7ae3..f3a0396680 100644
--- a/data/2026/CVE-2026-125370.json
+++ b/data/2026/CVE-2026-125370.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"kubero","vendor":"kubero-dev","versions":[{"lessThanOrEqual":"3.1.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens."}],"id":"CVE-2026-125370","lastModified":"2026-11-10T00:17:09.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:09.237","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/kubero-dev/kubero"},{"source":"disclosure@vulncheck.com","url":"https://github.com/kubero-dev/kubero/blob/bcb52376b19347b8c36bc445ddf3e4bff4a5c168/server/src/auth/strategies/jwt.strategy.ts#L13-L32"},{"source":"disclosure@vulncheck.com","url":"https://github.com/kubero-dev/kubero/issues/786"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"kubero","vendor":"kubero-dev","versions":[{"lessThanOrEqual":"3.1.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens."}],"id":"CVE-2026-125370","lastModified":"2026-11-13T14:17:53.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125370","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:51:49.417374Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:09.237","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/kubero-dev/kubero"},{"source":"disclosure@vulncheck.com","url":"https://github.com/kubero-dev/kubero/blob/bcb52376b19347b8c36bc445ddf3e4bff4a5c168/server/src/auth/strategies/jwt.strategy.ts#L13-L32"},{"source":"disclosure@vulncheck.com","url":"https://github.com/kubero-dev/kubero/issues/786"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/kubero-3.0.0-through-3.1.1-authentication-bypass-via-hardcoded-jwt-secret"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/kubero-dev/kubero/issues/786"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125374.json b/data/2026/CVE-2026-125374.json
index 9c2efb7deb..139561340c 100644
--- a/data/2026/CVE-2026-125374.json
+++ b/data/2026/CVE-2026-125374.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/krayin/laravel-crm","product":"laravel-crm","vendor":"krayin","versions":[{"lessThan":"2.2.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope."}],"id":"CVE-2026-125374","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:09.967","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm"},{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm/blob/999b596d0f53cb11c9b029f733a1d67e01fccda6/packages/Webkul/Admin/src/Http/Controllers/Lead/TagController.php#L26-L55"},{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm/commit/3cfa2f763563723469dd1cb7ab53e51b269139bc"},{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm/commit/95e0dbc83a72933aeaf72190a0f570ea1ddcc452"},{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm/releases/tag/v2.2.8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/krayin-crm-before-2.2.8-broken-object-level-authorization-via-lead-tag-attach-detach"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/krayin/laravel-crm","product":"laravel-crm","vendor":"krayin","versions":[{"lessThan":"2.2.8","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads owned by users outside their scope."}],"id":"CVE-2026-125374","lastModified":"2026-11-13T14:17:53.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125374","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:56:09.442904Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:09.967","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm"},{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm/blob/999b596d0f53cb11c9b029f733a1d67e01fccda6/packages/Webkul/Admin/src/Http/Controllers/Lead/TagController.php#L26-L55"},{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm/commit/3cfa2f763563723469dd1cb7ab53e51b269139bc"},{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm/commit/95e0dbc83a72933aeaf72190a0f570ea1ddcc452"},{"source":"disclosure@vulncheck.com","url":"https://github.com/krayin/laravel-crm/releases/tag/v2.2.8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/krayin-crm-before-2.2.8-broken-object-level-authorization-via-lead-tag-attach-detach"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125800.json b/data/2026/CVE-2026-125800.json
new file mode 100644
index 0000000000..beb4012a7d
--- /dev/null
+++ b/data/2026/CVE-2026-125800.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-125800","lastModified":"2026-11-13T14:17:53.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T14:17:53.567","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125801.json b/data/2026/CVE-2026-125801.json
new file mode 100644
index 0000000000..abed317784
--- /dev/null
+++ b/data/2026/CVE-2026-125801.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"woocommerce","product":"WooCommerce","vendor":"Automattic","versions":[{"changes":[{"at":"11.3.0","status":"unaffected"}],"lessThanOrEqual":"11.2.2","status":"affected","version":"11.0.0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2."}],"id":"CVE-2026-125801","lastModified":"2026-11-13T13:18:21.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.217","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-11-0-0-11-2-2-race-condition-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125814.json b/data/2026/CVE-2026-125814.json
new file mode 100644
index 0000000000..3b0c3382a7
--- /dev/null
+++ b/data/2026/CVE-2026-125814.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"woo-product-feed-pro","product":"Product Feed PRO for WooCommerce","vendor":"Rymera Web Co","versions":[{"changes":[{"at":"13.5.9","status":"unaffected"}],"lessThanOrEqual":"13.5.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Code Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.8."}],"id":"CVE-2026-125814","lastModified":"2026-11-13T13:18:21.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.360","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/woo-product-feed-pro/vulnerability/wordpress-product-feed-pro-for-woocommerce-plugin-13-5-8-content-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125815.json b/data/2026/CVE-2026-125815.json
new file mode 100644
index 0000000000..5134c75a1b
--- /dev/null
+++ b/data/2026/CVE-2026-125815.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"opening-hours","product":"We’re Open!","vendor":"Noah Hearle","versions":[{"changes":[{"at":"2.9","status":"unaffected"}],"lessThanOrEqual":"2.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8."}],"id":"CVE-2026-125815","lastModified":"2026-11-13T13:18:21.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.500","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/opening-hours/vulnerability/wordpress-we-re-open-plugin-2-8-content-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125816.json b/data/2026/CVE-2026-125816.json
new file mode 100644
index 0000000000..627163a233
--- /dev/null
+++ b/data/2026/CVE-2026-125816.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mapsvg-lite-interactive-vector-maps","product":"MapSVG","vendor":"PT Norther Lights Production","versions":[{"changes":[{"at":"9.0.5","status":"unaffected"}],"lessThanOrEqual":"9.0.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4."}],"id":"CVE-2026-125816","lastModified":"2026-11-13T13:18:21.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.647","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-9-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-125833.json b/data/2026/CVE-2026-125833.json
new file mode 100644
index 0000000000..2c3d81d922
--- /dev/null
+++ b/data/2026/CVE-2026-125833.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"yith-woocommerce-ajax-navigation","product":"YITH WooCommerce Ajax Product Filter","vendor":"YITH","versions":[{"changes":[{"at":"5.25.0","status":"unaffected"}],"lessThanOrEqual":"5.24.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation allows Stored XSS.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through 5.24.0."}],"id":"CVE-2026-125833","lastModified":"2026-11-13T13:18:21.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.790","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/yith-woocommerce-ajax-navigation/vulnerability/wordpress-yith-woocommerce-ajax-product-filter-plugin-5-24-0-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126182.json b/data/2026/CVE-2026-126182.json
index 5431bade50..14a96b144e 100644
--- a/data/2026/CVE-2026-126182.json
+++ b/data/2026/CVE-2026-126182.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests."}],"id":"CVE-2026-126182","lastModified":"2026-11-13T05:18:19.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-11T22:17:17.133","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper control of generation of code ('code injection') vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow a remote authenticated attacker to execute unauthorized code or commands via crafted HTTP requests."}],"id":"CVE-2026-126182","lastModified":"2026-11-13T14:17:53.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:11.869303Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:17.133","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-227"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126213.json b/data/2026/CVE-2026-126213.json
index 39a78bbf9c..c305798d82 100644
--- a/data/2026/CVE-2026-126213.json
+++ b/data/2026/CVE-2026-126213.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.13:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.12","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.13","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4 all versions, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests."}],"id":"CVE-2026-126213","lastModified":"2026-11-12T19:16:57.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126213","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:54:54.758659Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.457","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortimanagercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortimanagercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:o:fortinet:fortianalyzer:8.0.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.12:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.0","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortianalyzercloud:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.12:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.11:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.10:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.9:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortianalyzercloud:7.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiAnalyzer Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.11","status":"affected","version":"7.4.1","versionType":"semver"},{"lessThanOrEqual":"7.2.12","status":"affected","version":"7.2.1","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated attacker to execute unauthorized SQL commands via specially crafted requests."}],"id":"CVE-2026-126213","lastModified":"2026-11-13T14:17:53.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126213","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:54:54.758659Z","version":"2.0.3"}}]},"published":"2026-11-11T22:17:18.457","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-233"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126261.json b/data/2026/CVE-2026-126261.json
index 5279de56d1..d0494ccde0 100644
--- a/data/2026/CVE-2026-126261.json
+++ b/data/2026/CVE-2026-126261.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.5","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.8","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets."}],"id":"CVE-2026-126261","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-10T23:17:20.897","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-275"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@fortinet.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:o:fortinet:fortimanager:8.0.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*","cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiManager","vendor":"Fortinet","versions":[{"status":"affected","version":"8.0.0"},{"lessThanOrEqual":"7.6.7","status":"affected","version":"7.6.0","versionType":"semver"},{"lessThanOrEqual":"7.4.5","status":"affected","version":"7.4.0","versionType":"semver"},{"lessThanOrEqual":"7.2.8","status":"affected","version":"7.2.0","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets."}],"id":"CVE-2026-126261","lastModified":"2026-11-13T14:17:54.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126261","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:33:51.018334Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:20.897","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-275"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127122.json b/data/2026/CVE-2026-127122.json
new file mode 100644
index 0000000000..ef6164407c
--- /dev/null
+++ b/data/2026/CVE-2026-127122.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past the end of the array, into the rest of the Application Relationship and, with more blocks, into the following one. The written data comes from the request. No established Application Relationship is needed, and the attacker requires ADJACENT network access. Builds with PNET_OPTION_MC_CR disabled are not affected."}],"id":"CVE-2026-127122","lastModified":"2026-11-13T14:17:54.657","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:54.500","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127123.json b/data/2026/CVE-2026-127123.json
new file mode 100644
index 0000000000..dd400dad82
--- /dev/null
+++ b/data/2026/CVE-2026-127123.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Application Relationship is gone, the cyclic data stops, and the resources of the Application Relationship are left referencing a cleared structure. Another host can then connect in its place. A host with ADJACENT network access that has observed the activity UUID of the connection, which is sent in clear in every RPC request, can do this with one PDU."}],"id":"CVE-2026-127123","lastModified":"2026-11-13T14:17:54.800","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:54.703","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-404"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127124.json b/data/2026/CVE-2026-127124.json
new file mode 100644
index 0000000000..3e2875cba8
--- /dev/null
+++ b/data/2026/CVE-2026-127124.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID, without a timeout, when the rest of the request never arrives. A session that does not get an Application Relationship is also kept after the response. Repeated fragments or requests with different activity UUIDs exhaust the available sessions, one UDP packet per session. Once they are exhausted the device no longer answers a Connect request until it is restarted. An unauthenticated attacker with ADJACENT network access can use this to cause a denial of service."}],"id":"CVE-2026-127124","lastModified":"2026-11-13T14:17:54.973","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:54.843","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127125.json b/data/2026/CVE-2026-127125.json
new file mode 100644
index 0000000000..cc070378a9
--- /dev/null
+++ b/data/2026/CVE-2026-127125.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"P-Net","vendor":"RT-Labs","versions":[{"lessThan":"1.0.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee"}],"cveTags":[],"descriptions":[{"lang":"en","value":"P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relationship that is sent on another activity than its Connect, and gets a fragmented response, is handled on a session without one. If the response is not acknowledged, a NULL pointer is dereferenced and the device crashes. A conformant IO-controller does not send such requests. The attacker must have observed the AR UUID of an established Application Relationship and requires ADJACENT network access."}],"id":"CVE-2026-127125","lastModified":"2026-11-13T14:17:55.190","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]},"published":"2026-11-13T14:17:55.077","references":[{"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","url":"https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf"}],"sourceIdentifier":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"4b71179a-3b92-4a9d-b9fc-af8b8ed579ee","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128790.json b/data/2026/CVE-2026-128790.json
new file mode 100644
index 0000000000..c1f93fabb4
--- /dev/null
+++ b/data/2026/CVE-2026-128790.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse BaSyx Go Components","vendor":"Eclipse Foundation","versions":[{"lessThan":"1.1.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's `FILTERLIST` fragment filters to single Submodel reads.\n\n\n\n`GET /submodels` removes the fields that a rule's `FILTERLIST` hides, but `GET /submodels/{submodelIdentifier}` and `GET /submodels/{submodelIdentifier}/$metadata` return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example `supplementalSemanticIds` keys that name the other parties allowed to read the Submodel.\n\n\n\nIf versioning is enabled (`history.mode` set to `api` or `audit`), `GET /submodels/{submodelIdentifier}/$history` and `GET /shells/{aasIdentifier}/$history` in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.3."}],"id":"CVE-2026-128790","lastModified":"2026-11-13T14:17:55.250","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-13T14:17:55.250","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/basyx-go-components/pull/855"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/basyx-go-components/pull/883"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.3"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/577"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1371#note_8664220"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128834.json b/data/2026/CVE-2026-128834.json
new file mode 100644
index 0000000000..5be0ffd737
--- /dev/null
+++ b/data/2026/CVE-2026-128834.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-128834","lastModified":"2026-11-13T13:18:22.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.997","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-13732.json b/data/2026/CVE-2026-13732.json
index 8159ba3133..d46fe83aa0 100644
--- a/data/2026/CVE-2026-13732.json
+++ b/data/2026/CVE-2026-13732.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.3-3.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.2-4.3.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-20.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-15.1.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-15.1.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-18.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-18.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-19.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-19.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.3-3.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:10.2-10.2.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:10.2-13.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.2-4.2.el9_6","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-ui-rhel10","product":"Red Hat Cost Management On-Premise 1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791460851","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gdb-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"17.2-6.2.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-kubernetes-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791978534","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791978528","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/haproxy-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791978528","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791964013","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791978693","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GDB's STABS debug format parser. The\nread_member_functions() function in gdb/stabsread.c contains a linked\nlist removal bug in the code that separates destructor and non-destructor\nmember functions of C++ classes. The bug causes the destructor entries to\nremain in the main function list while the list length counter is\ndecremented, resulting in an out-of-bounds write when the function list\nis copied to its final allocated array. An attacker can craft an ELF\nbinary with malicious .stab and .stabstr sections that triggers this\nout-of-bounds write when a user opens the file in GDB and performs any\nsymbol-inspection operation such as setting a breakpoint. The inferior\nprocess does not need to be executed. Under controlled conditions, this\nwas demonstrated to achieve execution of arbitrary commands within the\nGDB process."}],"id":"CVE-2026-13732","lastModified":"2026-11-12T12:18:23.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-13732","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-01T14:33:22.469791Z","version":"2.0.3"}}]},"published":"2026-08-31T20:17:02.180","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:73425"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:73426"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:73427"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79357"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82447"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82939"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96095"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96096"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96097"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96098"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99594"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99596"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99597"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-13732"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494416"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.3-3.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.2-4.3.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-20.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-15.1.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream","cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-15.1.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-18.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream","cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-18.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-19.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream","cpe:/a:redhat:rhel_tus:8.8::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.2-19.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:16.3-3.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:10.2-10.2.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:10.2-13.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:14.2-4.2.el9_6","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-ui-rhel10","product":"Red Hat Cost Management On-Premise 1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791460851","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"gdb-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"17.2-6.2.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259031","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259119","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259034","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259393","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.0::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794260794","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.1-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794260631","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259404","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259570","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259370","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259815","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794260191","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259182","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-6.4-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259064","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794260782","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-13.0-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259958","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-neuron-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259318","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-gaudi-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259380","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rubin-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259862","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259110","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-rocm-7.14-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259559","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-tpu-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259807","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-cuda-12.9-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259456","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.5::el9"],"defaultStatus":"affected","packageName":"rhai/base-image-spyre-rhel9","product":"Red Hat OpenShift AI 3.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1794259162","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-kubernetes-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791978534","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/cds-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791978528","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/haproxy-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791978528","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791964013","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791978693","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gdb","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GDB's STABS debug format parser. The\nread_member_functions() function in gdb/stabsread.c contains a linked\nlist removal bug in the code that separates destructor and non-destructor\nmember functions of C++ classes. The bug causes the destructor entries to\nremain in the main function list while the list length counter is\ndecremented, resulting in an out-of-bounds write when the function list\nis copied to its final allocated array. An attacker can craft an ELF\nbinary with malicious .stab and .stabstr sections that triggers this\nout-of-bounds write when a user opens the file in GDB and performs any\nsymbol-inspection operation such as setting a breakpoint. The inferior\nprocess does not need to be executed. Under controlled conditions, this\nwas demonstrated to achieve execution of arbitrary commands within the\nGDB process."}],"id":"CVE-2026-13732","lastModified":"2026-11-13T13:18:22.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-13732","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-01T14:33:22.469791Z","version":"2.0.3"}}]},"published":"2026-08-31T20:17:02.180","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:73425"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:73426"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:73427"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79357"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82447"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82939"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96095"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96096"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96097"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96098"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98414"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98415"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98416"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98417"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98419"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98420"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98421"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98423"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98427"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98428"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98429"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98430"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98431"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98432"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98434"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98435"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98436"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98437"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98438"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98439"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98440"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98441"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98443"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99594"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99596"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99597"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-13732"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494416"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-44685.json b/data/2026/CVE-2026-44685.json
index 894e61f624..5e98e765ad 100644
--- a/data/2026/CVE-2026-44685.json
+++ b/data/2026/CVE-2026-44685.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing in the MigTD rebinding protocol for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-44685","lastModified":"2026-11-13T05:18:39.787","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-44685","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:40.273","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing in the MigTD rebinding protocol for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-44685","lastModified":"2026-11-13T14:17:55.423","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-44685","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:02.779046Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:40.273","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-49329.json b/data/2026/CVE-2026-49329.json
index 041d228ac3..f0fd6c75d6 100644
--- a/data/2026/CVE-2026-49329.json
+++ b/data/2026/CVE-2026-49329.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel8","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791839120","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791598539","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792883889","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790882323","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790611633","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790702087","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790707106","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790713150","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift5/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users."}],"id":"CVE-2026-49329","lastModified":"2026-10-30T05:16:59.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-49329","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-01T17:05:19.987171Z","version":"2.0.3"}}]},"published":"2026-09-01T16:16:57.760","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74380"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74383"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74429"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74434"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79039"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82785"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82813"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-49329"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483248"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel8","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793823075","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel8","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791839120","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791598539","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792883889","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793907184","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790882323","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790611633","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790702087","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790707106","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790713150","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift5/ose-oauth-server-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: the upstream guard counts only '-' characters but the internal BCP 47 scanner aliases '_' to '-' after the guard check. An unauthenticated attacker can send a crafted Accept-Language header using '_' separators to trigger quadratic-time parsing, consuming excessive CPU and denying authentication to all cluster users."}],"id":"CVE-2026-49329","lastModified":"2026-11-13T13:18:23.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-49329","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-01T17:05:19.987171Z","version":"2.0.3"}}]},"published":"2026-09-01T16:16:57.760","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74380"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74383"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74429"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74434"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79039"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82785"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82813"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95746"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96283"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-49329"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483248"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-50175.json b/data/2026/CVE-2026-50175.json
index 7c875ba468..067abf3919 100644
--- a/data/2026/CVE-2026-50175.json
+++ b/data/2026/CVE-2026-50175.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Slim Bootloader","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference in the FirmwareWakingVector for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-50175","lastModified":"2026-11-13T05:18:39.933","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-50175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:40.550","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Slim Bootloader","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference in the FirmwareWakingVector for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-50175","lastModified":"2026-11-13T14:17:55.557","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-50175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:04.052241Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:40.550","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-822"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56432.json b/data/2026/CVE-2026-56432.json
index f241dd53c3..208dac5b03 100644
--- a/data/2026/CVE-2026-56432.json
+++ b/data/2026/CVE-2026-56432.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unintended proxy or intermediary ('confused deputy') in the MigTD signing for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."}],"id":"CVE-2026-56432","lastModified":"2026-11-13T05:18:41.167","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:41.230","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unintended proxy or intermediary ('confused deputy') in the MigTD signing for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."}],"id":"CVE-2026-56432","lastModified":"2026-11-13T14:17:55.687","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56432","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:06.586103Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:41.230","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56435.json b/data/2026/CVE-2026-56435.json
index d9e7388914..2f65c63226 100644
--- a/data/2026/CVE-2026-56435.json
+++ b/data/2026/CVE-2026-56435.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-56435","lastModified":"2026-11-13T05:18:41.303","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56435","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:41.370","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-56435","lastModified":"2026-11-13T14:17:55.817","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56435","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:08.867598Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:41.370","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56759.json b/data/2026/CVE-2026-56759.json
index a0e381bee7..70ff46514c 100644
--- a/data/2026/CVE-2026-56759.json
+++ b/data/2026/CVE-2026-56759.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in the MigTD PCI BAR handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-56759","lastModified":"2026-11-13T05:18:41.443","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:41.673","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in the MigTD PCI BAR handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-56759","lastModified":"2026-11-13T14:17:55.950","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:12.597603Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:41.673","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56938.json b/data/2026/CVE-2026-56938.json
index 20bf707660..787316c990 100644
--- a/data/2026/CVE-2026-56938.json
+++ b/data/2026/CVE-2026-56938.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56938","lastModified":"2026-11-13T05:18:43.000","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56938","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.193","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In port_shutdown of ipc.c, there is a possible Use After Free due to a race condition. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56938","lastModified":"2026-11-13T14:17:56.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56938","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:40.915521Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.193","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"},{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56944.json b/data/2026/CVE-2026-56944.json
index df9403ffad..40554f5c9e 100644
--- a/data/2026/CVE-2026-56944.json
+++ b/data/2026/CVE-2026-56944.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56944","lastModified":"2026-11-13T05:18:43.110","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56944","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.407","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_detach_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56944","lastModified":"2026-11-13T14:17:56.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56944","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:42.069737Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.407","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56946.json b/data/2026/CVE-2026-56946.json
index 0cf54f45f3..48f65055a9 100644
--- a/data/2026/CVE-2026-56946.json
+++ b/data/2026/CVE-2026-56946.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56946","lastModified":"2026-11-13T05:18:43.223","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56946","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.533","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56946","lastModified":"2026-11-13T14:17:56.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56946","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:18.884111Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:16.533","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56969.json b/data/2026/CVE-2026-56969.json
index cc552db627..212fb314a1 100644
--- a/data/2026/CVE-2026-56969.json
+++ b/data/2026/CVE-2026-56969.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56969","lastModified":"2026-11-13T05:18:43.673","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56969","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.220","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-56969","lastModified":"2026-11-13T14:17:56.553","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56969","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:15.368844Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.220","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57010.json b/data/2026/CVE-2026-57010.json
index 929bee3881..78faf1bc1d 100644
--- a/data/2026/CVE-2026-57010.json
+++ b/data/2026/CVE-2026-57010.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-57010","lastModified":"2026-11-13T05:18:44.627","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57010","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.963","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In EncodeLastScanBufferElement of data_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-57010","lastModified":"2026-11-13T14:17:56.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57010","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:19.983766Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.963","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"},{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57043.json b/data/2026/CVE-2026-57043.json
index 0d1a0e9e98..fb6dbeb615 100644
--- a/data/2026/CVE-2026-57043.json
+++ b/data/2026/CVE-2026-57043.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-57043","lastModified":"2026-11-13T05:18:45.050","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:18.373","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In tipc_dev_probe of tipc_virtio_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-57043","lastModified":"2026-11-13T14:17:56.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57043","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:30.243920Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:18.373","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57048.json b/data/2026/CVE-2026-57048.json
index 8ed2fba36f..6684724395 100644
--- a/data/2026/CVE-2026-57048.json
+++ b/data/2026/CVE-2026-57048.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-57048","lastModified":"2026-11-13T05:18:45.300","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57048","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:18.577","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In authenticate of verify_image, there is a possible Signature verification logic bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-57048","lastModified":"2026-11-13T14:17:57.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57048","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:44.389473Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:18.577","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57882.json b/data/2026/CVE-2026-57882.json
index 3f217a6043..8e3d9860f0 100644
--- a/data/2026/CVE-2026-57882.json
+++ b/data/2026/CVE-2026-57882.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-57882","lastModified":"2026-11-13T05:18:45.420","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57882","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:41.813","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-57882","lastModified":"2026-11-13T14:17:57.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57882","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:15.172381Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:41.813","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57891.json b/data/2026/CVE-2026-57891.json
index 5d49b63cb9..ef428fe4fe 100644
--- a/data/2026/CVE-2026-57891.json
+++ b/data/2026/CVE-2026-57891.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-57891","lastModified":"2026-11-13T05:18:45.553","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:42.073","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-57891","lastModified":"2026-11-13T14:17:57.387","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:16.287815Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:42.073","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57892.json b/data/2026/CVE-2026-57892.json
index 3e20d0bec5..6273d6a5ad 100644
--- a/data/2026/CVE-2026-57892.json
+++ b/data/2026/CVE-2026-57892.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient granularity of access control in the MigTD v2 policy evaluation engine for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. Network adversary with an unauthenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."}],"id":"CVE-2026-57892","lastModified":"2026-11-13T05:18:45.700","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:42.210","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient granularity of access control in the MigTD v2 policy evaluation engine for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. Network adversary with an unauthenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."}],"id":"CVE-2026-57892","lastModified":"2026-11-13T14:17:57.513","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:17.455994Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:42.210","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57893.json b/data/2026/CVE-2026-57893.json
index 12177434b9..6eb24605b0 100644
--- a/data/2026/CVE-2026-57893.json
+++ b/data/2026/CVE-2026-57893.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete internal state distinction in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-57893","lastModified":"2026-11-13T05:18:45.840","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:42.350","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-372"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete internal state distinction in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-57893","lastModified":"2026-11-13T14:17:57.630","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:19.839230Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:42.350","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-372"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58680.json b/data/2026/CVE-2026-58680.json
index 10137c3034..e6ccb08752 100644
--- a/data/2026/CVE-2026-58680.json
+++ b/data/2026/CVE-2026-58680.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58680","lastModified":"2026-11-13T05:18:45.980","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.050","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In cpm_mbox_power_ctrl_sswrp of cpm_mbox.c, there is a possible permission bypass due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58680","lastModified":"2026-11-13T14:17:57.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:21.082848Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:23.050","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58736.json b/data/2026/CVE-2026-58736.json
index 8a184e3eb4..44443be4f8 100644
--- a/data/2026/CVE-2026-58736.json
+++ b/data/2026/CVE-2026-58736.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in the pending response queue due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58736","lastModified":"2026-11-13T05:18:47.160","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58736","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.293","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in the pending response queue due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58736","lastModified":"2026-11-13T14:17:57.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58736","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:24.111210Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.293","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58779.json b/data/2026/CVE-2026-58779.json
index c72acb2906..4749c597c0 100644
--- a/data/2026/CVE-2026-58779.json
+++ b/data/2026/CVE-2026-58779.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58779","lastModified":"2026-11-13T05:18:47.573","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58779","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:25.303","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58779","lastModified":"2026-11-13T14:17:58.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58779","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:26.528034Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:25.303","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58780.json b/data/2026/CVE-2026-58780.json
index c4e8ac5b56..0e95dba23d 100644
--- a/data/2026/CVE-2026-58780.json
+++ b/data/2026/CVE-2026-58780.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58780","lastModified":"2026-11-13T05:18:47.690","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58780","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:25.403","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58780","lastModified":"2026-11-13T14:17:58.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58780","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:28.770818Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:25.403","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58787.json b/data/2026/CVE-2026-58787.json
index 98d309be8e..d3115ecbba 100644
--- a/data/2026/CVE-2026-58787.json
+++ b/data/2026/CVE-2026-58787.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In chppWifiRangingEventNotification of clients/wifi.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58787","lastModified":"2026-11-13T05:18:48.027","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.033","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In chppWifiRangingEventNotification of clients/wifi.c, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-58787","lastModified":"2026-11-13T14:17:58.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:07.978584Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.033","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58798.json b/data/2026/CVE-2026-58798.json
index 44b545057d..c16c6676fd 100644
--- a/data/2026/CVE-2026-58798.json
+++ b/data/2026/CVE-2026-58798.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of cn_Tai.cpp, there is a possible way to trigger an out of bounds write due to memory corruption. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58798","lastModified":"2026-11-13T05:18:48.770","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.853","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of cn_Tai.cpp, there is a possible way to trigger an out of bounds write due to memory corruption. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58798","lastModified":"2026-11-13T14:17:58.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:50.399809Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:26.853","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58800.json b/data/2026/CVE-2026-58800.json
index 8c2a858a63..6f3c8878f5 100644
--- a/data/2026/CVE-2026-58800.json
+++ b/data/2026/CVE-2026-58800.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In IMG_vkCreateImageView of image_view.c, there is a possible way to trigger a use after free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58800","lastModified":"2026-11-13T05:18:48.997","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58800","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.060","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In IMG_vkCreateImageView of image_view.c, there is a possible way to trigger a use after free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58800","lastModified":"2026-11-13T14:17:58.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58800","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:51.542636Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.060","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59598.json b/data/2026/CVE-2026-59598.json
index 8cda9cb5b6..5288ca6621 100644
--- a/data/2026/CVE-2026-59598.json
+++ b/data/2026/CVE-2026-59598.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In platform_rio_ncp_wdt_handler of edgetpu_rio.c, there is a possible Use After Free due to a use after free. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59598","lastModified":"2026-11-13T05:18:50.707","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59598","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.443","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In platform_rio_ncp_wdt_handler of edgetpu_rio.c, there is a possible Use After Free due to a use after free. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-59598","lastModified":"2026-11-13T14:17:58.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59598","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:42.787047Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:30.443","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59609.json b/data/2026/CVE-2026-59609.json
index 3b2fa013d3..7ad42ed1cf 100644
--- a/data/2026/CVE-2026-59609.json
+++ b/data/2026/CVE-2026-59609.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59609","lastModified":"2026-11-13T05:18:51.207","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.283","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59609","lastModified":"2026-11-13T14:17:59.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:48.637521Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:31.283","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-60138.json b/data/2026/CVE-2026-60138.json
index ac1c136561..480fa334ec 100644
--- a/data/2026/CVE-2026-60138.json
+++ b/data/2026/CVE-2026-60138.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-60138","lastModified":"2026-11-13T05:18:52.487","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60138","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:43.193","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-823"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-60138","lastModified":"2026-11-13T14:17:59.287","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60138","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:26.678451Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:43.193","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-823"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-60142.json b/data/2026/CVE-2026-60142.json
index 488d060501..7556e5d8c4 100644
--- a/data/2026/CVE-2026-60142.json
+++ b/data/2026/CVE-2026-60142.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Write-what-where condition in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-60142","lastModified":"2026-11-13T05:18:52.623","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:43.610","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-123"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Write-what-where condition in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-60142","lastModified":"2026-11-13T14:17:59.400","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-60142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:27.891827Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:43.610","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-123"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-61467.json b/data/2026/CVE-2026-61467.json
index f27a4224a4..16df8983b6 100644
--- a/data/2026/CVE-2026-61467.json
+++ b/data/2026/CVE-2026-61467.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in the MigTD virtio driver for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-61467","lastModified":"2026-11-13T05:18:52.760","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61467","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:44.010","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in the MigTD virtio driver for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-61467","lastModified":"2026-11-13T14:17:59.517","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61467","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:32.592224Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:44.010","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-61473.json b/data/2026/CVE-2026-61473.json
index 8c1e9cb634..9765da3523 100644
--- a/data/2026/CVE-2026-61473.json
+++ b/data/2026/CVE-2026-61473.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."}],"id":"CVE-2026-61473","lastModified":"2026-11-13T05:18:52.907","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61473","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:44.563","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts."}],"id":"CVE-2026-61473","lastModified":"2026-11-13T14:17:59.630","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61473","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:34.831993Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:44.563","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-61812.json b/data/2026/CVE-2026-61812.json
index c7fd26a505..4c53b4ea3d 100644
--- a/data/2026/CVE-2026-61812.json
+++ b/data/2026/CVE-2026-61812.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":"< 2.9.15"},{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser or backend. Attackers can encode ASCII separators and operators with unhandled entity names, including aliases, to bypass rules that depend on the transformation. The v3 decoder also accepts prefix matches instead of requiring an exact entity-token length, which can transform invalid longer names into different bytes. This issue is fixed in versions 2.9.15 and 3.0.17."}],"id":"CVE-2026-61812","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:53.050","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/6353be7b09ff222d29a7491c26307d293b00d56f"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/77be8039d734d36ec291d8fbda9e69326ae44755"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cxqf-vgrr-xxrv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-172"},{"lang":"en","value":"CWE-180"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":"< 2.9.15"},{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser or backend. Attackers can encode ASCII separators and operators with unhandled entity names, including aliases, to bypass rules that depend on the transformation. The v3 decoder also accepts prefix matches instead of requiring an exact entity-token length, which can transform invalid longer names into different bytes. This issue is fixed in versions 2.9.15 and 3.0.17."}],"id":"CVE-2026-61812","lastModified":"2026-11-13T14:17:59.747","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:20:47.963570Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:53.050","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/6353be7b09ff222d29a7491c26307d293b00d56f"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/77be8039d734d36ec291d8fbda9e69326ae44755"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cxqf-vgrr-xxrv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-172"},{"lang":"en","value":"CWE-180"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-61887.json b/data/2026/CVE-2026-61887.json
index 20f2e34bf6..bbc5471845 100644
--- a/data/2026/CVE-2026-61887.json
+++ b/data/2026/CVE-2026-61887.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-61887","lastModified":"2026-11-13T05:18:53.080","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61887","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:44.703","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts."}],"id":"CVE-2026-61887","lastModified":"2026-11-13T14:17:59.867","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61887","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:40.630401Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:44.703","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-62275.json b/data/2026/CVE-2026-62275.json
index afb94d7705..10b3dfd46a 100644
--- a/data/2026/CVE-2026-62275.json
+++ b/data/2026/CVE-2026-62275.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62275","lastModified":"2026-11-13T05:18:53.227","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62275","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:44.860","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62275","lastModified":"2026-11-13T14:17:59.987","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62275","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:45.346727Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:44.860","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-62929.json b/data/2026/CVE-2026-62929.json
index 383740cf12..6b241e3327 100644
--- a/data/2026/CVE-2026-62929.json
+++ b/data/2026/CVE-2026-62929.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Expired pointer dereference in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62929","lastModified":"2026-11-13T05:18:53.373","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62929","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T18:17:45.130","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-825"}],"source":"secure@intel.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Intel(R) TDX Migration Trust Domain (MigTD)","vendor":"n/a","versions":[{"status":"affected","version":"See references"}]}],"source":"secure@intel.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Expired pointer dereference in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts."}],"id":"CVE-2026-62929","lastModified":"2026-11-13T14:18:00.123","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"secure@intel.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-62929","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T04:59:49.819167Z","version":"2.0.3"}}]},"published":"2026-11-10T18:17:45.130","references":[{"source":"secure@intel.com","url":"https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}],"sourceIdentifier":"secure@intel.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-825"}],"source":"secure@intel.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63497.json b/data/2026/CVE-2026-63497.json
index 531fb11ecc..08f1f7f812 100644
--- a/data/2026/CVE-2026-63497.json
+++ b/data/2026/CVE-2026-63497.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"titra","vendor":"titraio","versions":[{"status":"affected","version":"<= 1.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches."}],"id":"CVE-2026-63497","lastModified":"2026-11-09T22:18:53.763","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:53.640","references":[{"source":"security-advisories@github.com","url":"https://github.com/titraio/titra/security/advisories/GHSA-cphv-qx83-x397"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"titra","vendor":"titraio","versions":[{"status":"affected","version":"<= 1.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches."}],"id":"CVE-2026-63497","lastModified":"2026-11-13T13:18:24.480","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63497","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:12:50.857656Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:53.640","references":[{"source":"security-advisories@github.com","url":"https://github.com/titraio/titra/security/advisories/GHSA-cphv-qx83-x397"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/titraio/titra/security/advisories/GHSA-cphv-qx83-x397"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-74"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-70555.json b/data/2026/CVE-2026-70555.json
index 2b123b9fc2..64f762acae 100644
--- a/data/2026/CVE-2026-70555.json
+++ b/data/2026/CVE-2026-70555.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","packageURL":"pkg:github/rconfig/rconfig","product":"rConfig","repo":"https://github.com/rconfig/rconfig","vendor":"rConfig","versions":[{"lessThan":"8.2.13","status":"affected","version":"8.2.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing authorization checks. Attackers can request GET /api/device-credentials, GET /api/device-credentials/{id}, or the external GET /api/v1/device-credentials endpoint, which authenticates any valid token as the seeded administrator account, to statelessly exfiltrate all stored plaintext device credentials. rConfig Pro is not affected."}],"id":"CVE-2026-70555","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T19:17:05.120","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rconfig/rconfig/commit/090d4481acaf0003a33581eeb486a540414ff806"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rconfig/rconfig/releases/tag/core-8.2.13"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rconfig-core-cleartext-credential-exposure-via-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","packageURL":"pkg:github/rconfig/rconfig","product":"rConfig","repo":"https://github.com/rconfig/rconfig","vendor":"rConfig","versions":[{"lessThan":"8.2.13","status":"affected","version":"8.2.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing authorization checks. Attackers can request GET /api/device-credentials, GET /api/device-credentials/{id}, or the external GET /api/v1/device-credentials endpoint, which authenticates any valid token as the seeded administrator account, to statelessly exfiltrate all stored plaintext device credentials. rConfig Pro is not affected."}],"id":"CVE-2026-70555","lastModified":"2026-11-13T13:18:25.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-70555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:36:20.813880Z","version":"2.0.3"}}]},"published":"2026-11-09T19:17:05.120","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/rconfig/rconfig/commit/090d4481acaf0003a33581eeb486a540414ff806"},{"source":"disclosure@vulncheck.com","url":"https://github.com/rconfig/rconfig/releases/tag/core-8.2.13"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/rconfig-core-cleartext-credential-exposure-via-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-75888.json b/data/2026/CVE-2026-75888.json
index f7326085a9..f4dcc360e4 100644
--- a/data/2026/CVE-2026-75888.json
+++ b/data/2026/CVE-2026-75888.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792976642","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791842061","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791836468","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792882312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792874271","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791626503","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791962432","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792057253","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791977124","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster."}],"id":"CVE-2026-75888","lastModified":"2026-10-30T05:16:59.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-75888","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:11:54.202336Z","version":"2.0.3"}}]},"published":"2026-10-12T17:17:35.723","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82785"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82813"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83480"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83502"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83541"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83702"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89726"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90274"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-75888"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517888"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792976642","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793823578","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791842061","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791836468","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792882312","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793877536","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792874271","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791626503","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791962432","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792057253","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791977124","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-console-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster."}],"id":"CVE-2026-75888","lastModified":"2026-11-13T13:18:26.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-75888","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:11:54.202336Z","version":"2.0.3"}}]},"published":"2026-10-12T17:17:35.723","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82785"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82813"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83480"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83502"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83541"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83702"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89726"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90274"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95746"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96283"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-75888"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517888"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-77685.json b/data/2026/CVE-2026-77685.json
index 657fa03997..3019ee8d67 100644
--- a/data/2026/CVE-2026-77685.json
+++ b/data/2026/CVE-2026-77685.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/bluetooth/host/classic/rfcomm.c","subsys/bluetooth/host/rfcomm.c"],"programRoutines":[{"name":"rfcomm_handle_msg"},{"name":"rfcomm_make_uih_msg"},{"name":"rfcomm_send_test"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"1.7.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RFCOMM_TEST command as buf->len - 1 and passed it to rfcomm_send_test(), whose length parameter is a uint8_t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf->len == 0 after rfcomm_handle_msg() pulls the two-byte MCC header, so buf->len - 1 underflows and narrows to 255.\n\nrfcomm_send_test() then copies 255 bytes out of a receive buffer that holds no remaining valid data, and appends them to an outgoing L2CAP PDU allocated with only CONFIG_BT_L2CAP_TX_MTU (253 by default for CONFIG_BT_CLASSIC) bytes of tailroom. The source read runs past the end of the ACL receive buffer into adjacent buffers of the same net_buf pool, and the destination copy overruns the transmit buffer by about eight bytes; net_buf_add_mem() performs no runtime bounds check in ordinary builds, where the underlying __ASSERT_NO_MSG() is compiled out.\n\nThe trigger is a single five-byte RFCOMM frame on the multiplexer control channel, which is processed as soon as the L2CAP channel for PSM 3 is established — before any DLC exists and independent of RFCOMM session state. bt_rfcomm_init() registers that L2CAP server with .sec_level = BT_SECURITY_L1, which l2cap_br_conn_security() accepts without any link key from a peer that does not claim host Secure Simple Pairing support, so an unpaired BR/EDR device in radio range of a connectable target with CONFIG_BT_RFCOMM enabled (SPP, HFP, HSP, GOEP and similar profiles all enable it) can reach the defect.\n\nThe resulting 255-byte TEST response is transmitted back to the attacker, disclosing roughly 255 bytes of adjacent stack/pool memory — including the contents of neighbouring receive buffers, which an attacker can prime with earlier packets — and the accompanying out-of-bounds write corrupts memory following the transmit buffer, which can crash the Bluetooth host. The request is trivially repeatable, so both the disclosure and the corruption can be driven at will.\n\nTwo fixes are needed, and the first on its own does not close the out-of-bounds write. Fix 1 (0040ef781e1d, #115768) strips the FCS byte in rfcomm_recv() and echoes buf->len, rejecting anything over UINT8_MAX, which removes the underflow and the over-read. But rfcomm_make_uih_msg() still allocates the response with bt_l2cap_create_pdu() and never compares the requested length with the buffer's tailroom, so a well-formed TEST command carrying a pattern of about 248 bytes or more still builds a response (3-byte frame header, 2-byte message header, pattern, FCS) larger than the 253 bytes available. A pattern that long can only be received when the RFCOMM L2CAP receive MTU (CONFIG_BT_RFCOMM_L2CAP_MTU, which defaults to CONFIG_BT_BUF_ACL_RX_SIZE) exceeds CONFIG_BT_L2CAP_TX_MTU. The plain BR/EDR defaults (200 against 253) cannot reach it, but from v4.3.0 enabling CONFIG_BT_GOEP raises CONFIG_BT_BUF_ACL_RX_SIZE to 264 (265 from v4.4.0), so GOEP builds with only fix 1 applied still overrun the transmit buffer by up to eight bytes. This includes v4.3.2, the last v4.3 release, which carries fix 1 but will not receive fix 2. Fix 2 (214530895dd3, #118293) checks the tailroom on every RFCOMM PDU allocation and closes this residual write."}],"id":"CVE-2026-77685","lastModified":"2026-11-10T22:20:53.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-10T22:20:53.717","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mhhp-8w67-cggv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-191"},{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/bluetooth/host/classic/rfcomm.c","subsys/bluetooth/host/rfcomm.c"],"programRoutines":[{"name":"rfcomm_handle_msg"},{"name":"rfcomm_make_uih_msg"},{"name":"rfcomm_send_test"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"1.7.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a BT_RFCOMM_TEST command as buf->len - 1 and passed it to rfcomm_send_test(), whose length parameter is a uint8_t. A malformed but FCS-valid UIH frame on DLCI 0 can leave buf->len == 0 after rfcomm_handle_msg() pulls the two-byte MCC header, so buf->len - 1 underflows and narrows to 255.\n\nrfcomm_send_test() then copies 255 bytes out of a receive buffer that holds no remaining valid data, and appends them to an outgoing L2CAP PDU allocated with only CONFIG_BT_L2CAP_TX_MTU (253 by default for CONFIG_BT_CLASSIC) bytes of tailroom. The source read runs past the end of the ACL receive buffer into adjacent buffers of the same net_buf pool, and the destination copy overruns the transmit buffer by about eight bytes; net_buf_add_mem() performs no runtime bounds check in ordinary builds, where the underlying __ASSERT_NO_MSG() is compiled out.\n\nThe trigger is a single five-byte RFCOMM frame on the multiplexer control channel, which is processed as soon as the L2CAP channel for PSM 3 is established — before any DLC exists and independent of RFCOMM session state. bt_rfcomm_init() registers that L2CAP server with .sec_level = BT_SECURITY_L1, which l2cap_br_conn_security() accepts without any link key from a peer that does not claim host Secure Simple Pairing support, so an unpaired BR/EDR device in radio range of a connectable target with CONFIG_BT_RFCOMM enabled (SPP, HFP, HSP, GOEP and similar profiles all enable it) can reach the defect.\n\nThe resulting 255-byte TEST response is transmitted back to the attacker, disclosing roughly 255 bytes of adjacent stack/pool memory — including the contents of neighbouring receive buffers, which an attacker can prime with earlier packets — and the accompanying out-of-bounds write corrupts memory following the transmit buffer, which can crash the Bluetooth host. The request is trivially repeatable, so both the disclosure and the corruption can be driven at will.\n\nTwo fixes are needed, and the first on its own does not close the out-of-bounds write. Fix 1 (0040ef781e1d, #115768) strips the FCS byte in rfcomm_recv() and echoes buf->len, rejecting anything over UINT8_MAX, which removes the underflow and the over-read. But rfcomm_make_uih_msg() still allocates the response with bt_l2cap_create_pdu() and never compares the requested length with the buffer's tailroom, so a well-formed TEST command carrying a pattern of about 248 bytes or more still builds a response (3-byte frame header, 2-byte message header, pattern, FCS) larger than the 253 bytes available. A pattern that long can only be received when the RFCOMM L2CAP receive MTU (CONFIG_BT_RFCOMM_L2CAP_MTU, which defaults to CONFIG_BT_BUF_ACL_RX_SIZE) exceeds CONFIG_BT_L2CAP_TX_MTU. The plain BR/EDR defaults (200 against 253) cannot reach it, but from v4.3.0 enabling CONFIG_BT_GOEP raises CONFIG_BT_BUF_ACL_RX_SIZE to 264 (265 from v4.4.0), so GOEP builds with only fix 1 applied still overrun the transmit buffer by up to eight bytes. This includes v4.3.2, the last v4.3 release, which carries fix 1 but will not receive fix 2. Fix 2 (214530895dd3, #118293) checks the tailroom on every RFCOMM PDU allocation and closes this residual write."}],"id":"CVE-2026-77685","lastModified":"2026-11-13T14:18:00.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-77685","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:37:27.178564Z","version":"2.0.3"}}]},"published":"2026-11-10T22:20:53.717","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/0040ef781e1d705066045850782cd8efa5beaa02"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/214530895dd327ef34468fb25e132df6976e927c"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mhhp-8w67-cggv"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-191"},{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-77706.json b/data/2026/CVE-2026-77706.json
new file mode 100644
index 0000000000..fb5dbe1014
--- /dev/null
+++ b/data/2026/CVE-2026-77706.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"FileOrbis NextGen FileServer","vendor":"Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi","versions":[{"lessThan":"12.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi FileOrbis NextGen FileServer allows Sustained Client Engagement.\n\nThis issue affects FileOrbis NextGen FileServer: before 12.7."}],"id":"CVE-2026-77706","lastModified":"2026-11-13T14:18:00.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-13T14:18:00.377","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1540"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-82177.json b/data/2026/CVE-2026-82177.json
new file mode 100644
index 0000000000..f0f06eaa2f
--- /dev/null
+++ b/data/2026/CVE-2026-82177.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance."}],"id":"CVE-2026-82177","lastModified":"2026-11-13T14:18:00.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.503","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-82179.json b/data/2026/CVE-2026-82179.json
new file mode 100644
index 0000000000..ac5b1acbe5
--- /dev/null
+++ b/data/2026/CVE-2026-82179.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an authorization bypass vulnerability. An authenticated administrator could exploit this vulnerability to bypass multi-approver controls on critical operations."}],"id":"CVE-2026-82179","lastModified":"2026-11-13T14:18:00.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.637","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-82391.json b/data/2026/CVE-2026-82391.json
index 95573fdc17..2525842ab1 100644
--- a/data/2026/CVE-2026-82391.json
+++ b/data/2026/CVE-2026-82391.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/net/lib/http/http_server_http2.c"],"programRoutines":[{"name":"handle_http2_static_fs_resource"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter of http_server_find_file(). client->data_len is the count of unprocessed bytes remaining in the fixed-size per-connection receive buffer client->buffer[CONFIG_HTTP_SERVER_CLIENT_BUFFER_SIZE] (256 bytes by default), an invariant every frame handler and the socket receive path rely on. Serving any static file therefore replaced that bounded value with the file's on-disk size, and nothing resets it afterwards.\n\nThe defect is reached by an unauthenticated HTTP/2 GET for any file under the web root, in applications that register a static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with CONFIG_FILE_SYSTEM=y; CONFIG_HTTP_SERVER_VERSION_2 is enabled by default and no TLS or credentials are required on this path. Once client->data_len exceeds the buffer size, the frame dispatch loop in subsys/net/lib/http/http_server_core.c keeps parsing past the end of the received data, and the peer controls the bytes at client->cursor, so it can choose which fabricated frame the state machine consumes next by appending bytes after its request.\n\nThe inflated length defeats the only guards on the buffer. parse_http_frame_header() and the per-frame handlers read and skip up to a 24-bit frame length beyond the buffer (out-of-bounds read); the compaction memmove(client->buffer, client->cursor, client->data_len) at the end of request handling copies the file-size number of bytes into the 256-byte buffer, overflowing the rest of struct http_client_ctx — including the current_detail/current_stream pointers, the parser_settings function-pointer table and the inactivity_timer work handler — and the adjacent client contexts in static memory; and the subsequent zsock_recv(client->fd, client->buffer + client->data_len, sizeof(client->buffer) - client->data_len, 0) underflows its size argument, writing attacker-supplied data of attacker-chosen length out of bounds.\n\nThe impact is remote memory corruption in the server's single address space: at minimum a crash or hang of the device, and plausibly control-data overwrite leading to code execution. The HTTP/1 and HTTP/3 static-filesystem handlers already used a local variable and are unaffected; the fix makes the HTTP/2 handler use a local size_t file_size as well."}],"id":"CVE-2026-82391","lastModified":"2026-11-10T22:21:05.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-10T22:21:05.710","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8jrg-wx88-g75j"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/net/lib/http/http_server_http2.c"],"programRoutines":[{"name":"handle_http2_static_fs_resource"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"4.0.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter of http_server_find_file(). client->data_len is the count of unprocessed bytes remaining in the fixed-size per-connection receive buffer client->buffer[CONFIG_HTTP_SERVER_CLIENT_BUFFER_SIZE] (256 bytes by default), an invariant every frame handler and the socket receive path rely on. Serving any static file therefore replaced that bounded value with the file's on-disk size, and nothing resets it afterwards.\n\nThe defect is reached by an unauthenticated HTTP/2 GET for any file under the web root, in applications that register a static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with CONFIG_FILE_SYSTEM=y; CONFIG_HTTP_SERVER_VERSION_2 is enabled by default and no TLS or credentials are required on this path. Once client->data_len exceeds the buffer size, the frame dispatch loop in subsys/net/lib/http/http_server_core.c keeps parsing past the end of the received data, and the peer controls the bytes at client->cursor, so it can choose which fabricated frame the state machine consumes next by appending bytes after its request.\n\nThe inflated length defeats the only guards on the buffer. parse_http_frame_header() and the per-frame handlers read and skip up to a 24-bit frame length beyond the buffer (out-of-bounds read); the compaction memmove(client->buffer, client->cursor, client->data_len) at the end of request handling copies the file-size number of bytes into the 256-byte buffer, overflowing the rest of struct http_client_ctx — including the current_detail/current_stream pointers, the parser_settings function-pointer table and the inactivity_timer work handler — and the adjacent client contexts in static memory; and the subsequent zsock_recv(client->fd, client->buffer + client->data_len, sizeof(client->buffer) - client->data_len, 0) underflows its size argument, writing attacker-supplied data of attacker-chosen length out of bounds.\n\nThe impact is remote memory corruption in the server's single address space: at minimum a crash or hang of the device, and plausibly control-data overwrite leading to code execution. The HTTP/1 and HTTP/3 static-filesystem handlers already used a local variable and are unaffected; the fix makes the HTTP/2 handler use a local size_t file_size as well."}],"id":"CVE-2026-82391","lastModified":"2026-11-13T14:18:00.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82391","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:35:55.858780Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:05.710","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8jrg-wx88-g75j"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-83589.json b/data/2026/CVE-2026-83589.json
index bcd848af7e..c4cc16913b 100644
--- a/data/2026/CVE-2026-83589.json
+++ b/data/2026/CVE-2026-83589.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792974337","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791837363","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791632336","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792878232","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790882320","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790807096","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790704224","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790706478","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790724885","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift5/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft."}],"id":"CVE-2026-83589","lastModified":"2026-10-30T05:16:59.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-83589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-01T16:11:43.615229Z","version":"2.0.3"}}]},"published":"2026-10-01T10:17:17.217","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74380"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74383"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74429"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79039"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79169"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82785"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82813"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90274"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-83589"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2518379"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792974337","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793822494","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791837363","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791632336","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792878232","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793876755","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790882320","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790807096","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790704224","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790706478","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1790724885","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"unaffected","packageName":"openshift5/ose-oauth-proxy-rhel9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft."}],"id":"CVE-2026-83589","lastModified":"2026-11-13T13:18:27.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-83589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-01T16:11:43.615229Z","version":"2.0.3"}}]},"published":"2026-10-01T10:17:17.217","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74380"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74383"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:74429"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79039"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79169"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82785"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82813"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90274"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95746"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96283"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-83589"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2518379"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-84503.json b/data/2026/CVE-2026-84503.json
index f5fa72e6ea..0d69d3bed7 100644
--- a/data/2026/CVE-2026-84503.json
+++ b/data/2026/CVE-2026-84503.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:2.16.19-4.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:2.16.19-4.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:migration_toolkit_applications:8"],"defaultStatus":"affected","packageName":"mta/mta-rhel9-operator","product":"Migration Toolkit for Applications 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:migration_toolkit_virtualization:2"],"defaultStatus":"affected","packageName":"migration-toolkit-virtualization/mtv-rhel9-operator","product":"Migration Toolkit for Virtualization","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:3"],"defaultStatus":"unaffected","packageName":"openshift-service-mesh/kiali-rhel9-operator","product":"OpenShift Service Mesh 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"],"defaultStatus":"unaffected","packageName":"rhacm2/volsync-operator-bundle","product":"Red Hat Advanced Cluster Management for Kubernetes 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"],"defaultStatus":"unaffected","packageName":"rhacm2/volsync-rhel9","product":"Red Hat Advanced Cluster Management for Kubernetes 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-24/de-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-24/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-24/lightspeed-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/ansible-dev-tools-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-25/de-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-25/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-25/eda-controller-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-25/lightspeed-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/ansible-dev-tools-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/de-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/eda-controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/ee-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/gateway-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-26/lightspeed-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/lightspeed-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/platform-resource-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/platform-resource-runner-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/aap-cloud-billing-operator-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/ansible-devspaces-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/ansible-dev-tools-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/de-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/eda-controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/ee-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/gateway-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-27/lightspeed-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/lightspeed-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/metrics-service-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/platform-resource-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/platform-resource-runner-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-tech-preview/ansible-devspaces-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-tech-preview/metrics-service-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_core:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform Ansible Core 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_core:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform Ansible Core 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_core:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-tech-preview/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform Ansible Core 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_core:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-tech-preview/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform Ansible Core 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certifications:9"],"defaultStatus":"affected","packageName":"rhcertification/redhat-certification-system-ai","product":"Red Hat Certification Program for Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:discovery:2::el8"],"defaultStatus":"affected","packageName":"discovery/discovery-server-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-ansible-rhel9-operator","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-ansible-rhel9-operator","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1"],"defaultStatus":"affected","packageName":"openstack-ansible-core","product":"Red Hat OpenStack Platform 17.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1"],"defaultStatus":"affected","packageName":"rhosp-rhel9/openstack-neutron-server","product":"Red Hat OpenStack Platform 17.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1"],"defaultStatus":"affected","packageName":"rhosp-rhel9/openstack-tripleoclient","product":"Red Hat OpenStack Platform 17.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0"],"defaultStatus":"affected","packageName":"rhoso-operators/ee-openstack-ansible-ee-rhel9","product":"Red Hat OpenStack Platform 18.0","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/installer-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_portal:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform/bootc-automation-portal-rhel9","product":"Self-service automation portal 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:stf:1.5"],"defaultStatus":"unaffected","packageName":"stf/service-telemetry-rhel9-operator","product":"Service Telemetry Framework 1.5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:stf:1.5"],"defaultStatus":"unaffected","packageName":"stf/smart-gateway-rhel9-operator","product":"Service Telemetry Framework 1.5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote, clone, fetch) with the repository URL as a positional\nargument and without a \"--\" separator, so a repository URL that begins with a\ndash is interpreted by git as a command-line option. A caller that passes an\nattacker-controlled repository URL to the module can trigger argument\ninjection (for example --upload-pack/--exec), resulting in arbitrary command\nexecution on the host running the module."}],"id":"CVE-2026-84503","lastModified":"2026-11-13T02:18:59.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-09T18:17:34.233","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-84503"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527098"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:2.16.19-4.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1:2.16.19-4.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:migration_toolkit_applications:8"],"defaultStatus":"affected","packageName":"mta/mta-rhel9-operator","product":"Migration Toolkit for Applications 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:migration_toolkit_virtualization:2"],"defaultStatus":"affected","packageName":"migration-toolkit-virtualization/mtv-rhel9-operator","product":"Migration Toolkit for Virtualization","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:3"],"defaultStatus":"unaffected","packageName":"openshift-service-mesh/kiali-rhel9-operator","product":"OpenShift Service Mesh 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"],"defaultStatus":"unaffected","packageName":"rhacm2/volsync-operator-bundle","product":"Red Hat Advanced Cluster Management for Kubernetes 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"],"defaultStatus":"unaffected","packageName":"rhacm2/volsync-rhel9","product":"Red Hat Advanced Cluster Management for Kubernetes 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-24/de-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-24/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-24/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-24/lightspeed-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/ansible-dev-tools-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-25/de-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-25/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-25/eda-controller-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-25/lightspeed-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/ansible-dev-tools-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/de-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/eda-controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/ee-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/gateway-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-26/lightspeed-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/lightspeed-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/platform-resource-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/platform-resource-runner-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/aap-cloud-billing-operator-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/ansible-devspaces-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/ansible-dev-tools-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/de-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/de-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/eda-controller-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/eda-controller-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/ee-supported-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/gateway-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-27/lightspeed-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/lightspeed-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/metrics-service-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/platform-resource-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/platform-resource-runner-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-tech-preview/ansible-devspaces-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-tech-preview/metrics-service-rhel9-operator","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_core:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform Ansible Core 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_core:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform Ansible Core 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_core:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-tech-preview/ee-minimal-rhel8","product":"Red Hat Ansible Automation Platform Ansible Core 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_core:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-tech-preview/ee-minimal-rhel9","product":"Red Hat Ansible Automation Platform Ansible Core 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:certifications:9"],"defaultStatus":"affected","packageName":"rhcertification/redhat-certification-system-ai","product":"Red Hat Certification Program for Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:discovery:2::el8"],"defaultStatus":"affected","packageName":"discovery/discovery-server-rhel9","product":"Red Hat Discovery 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"ansible-core","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ose-ansible-rhel9-operator","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-ansible-rhel9-operator","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1"],"defaultStatus":"affected","packageName":"openstack-ansible-core","product":"Red Hat OpenStack Platform 17.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1"],"defaultStatus":"affected","packageName":"rhosp-rhel9/openstack-neutron-server","product":"Red Hat OpenStack Platform 17.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:17.1"],"defaultStatus":"affected","packageName":"rhosp-rhel9/openstack-tripleoclient","product":"Red Hat OpenStack Platform 17.1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0"],"defaultStatus":"affected","packageName":"rhoso-operators/ee-openstack-ansible-ee-rhel9","product":"Red Hat OpenStack Platform 18.0","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/installer-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/installer-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_portal:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform/bootc-automation-portal-rhel9","product":"Self-service automation portal 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:stf:1.5"],"defaultStatus":"unaffected","packageName":"stf/service-telemetry-rhel9-operator","product":"Service Telemetry Framework 1.5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:stf:1.5"],"defaultStatus":"unaffected","packageName":"stf/smart-gateway-rhel9-operator","product":"Service Telemetry Framework 1.5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote, clone, fetch) with the repository URL as a positional\nargument and without a \"--\" separator, so a repository URL that begins with a\ndash is interpreted by git as a command-line option. A caller that passes an\nattacker-controlled repository URL to the module can trigger argument\ninjection (for example --upload-pack/--exec), resulting in arbitrary command\nexecution on the host running the module."}],"id":"CVE-2026-84503","lastModified":"2026-11-13T13:18:28.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-84503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T12:30:14.416545Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:34.233","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-84503"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527098"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-86353.json b/data/2026/CVE-2026-86353.json
new file mode 100644
index 0000000000..7c9fea9e53
--- /dev/null
+++ b/data/2026/CVE-2026-86353.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existing privileged access to the appliance to recover stored credentials."}],"id":"CVE-2026-86353","lastModified":"2026-11-13T14:18:00.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":4.2,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.903","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-327"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-86355.json b/data/2026/CVE-2026-86355.json
new file mode 100644
index 0000000000..7d4d0b09fb
--- /dev/null
+++ b/data/2026/CVE-2026-86355.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or late","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance."}],"id":"CVE-2026-86355","lastModified":"2026-11-13T13:18:29.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:18:29.887","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-86356.json b/data/2026/CVE-2026-86356.json
new file mode 100644
index 0000000000..9851108df2
--- /dev/null
+++ b/data/2026/CVE-2026-86356.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator."}],"id":"CVE-2026-86356","lastModified":"2026-11-13T13:18:30.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T13:18:30.020","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-87042.json b/data/2026/CVE-2026-87042.json
index 9d505e43c1..6f7e1d414e 100644
--- a/data/2026/CVE-2026-87042.json
+++ b/data/2026/CVE-2026-87042.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/net/lib/ptp/port.c"],"programRoutines":[{"name":"port_delay_resp_msg_process"},{"name":"port_sync_msg_process"},{"name":"port_timer_set_timeout"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.7.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received Delay_Resp message without any validation. port_delay_resp_msg_process() stored the raw wire value (a full-range int8_t) into port_ds.log_min_delay_req_interval, and that value is later used as a shift count by port_timer_set_timeout() when the Delay_Req timer is armed. Values below about -30 truncate the computed timeout to zero, and values with a magnitude of 64 or more perform an undefined shift of a uint64_t; the standards-defined \"not applicable\" encoding 0x7F fell into the latter case as well.\n\nPTP messages are received over unauthenticated link-local traffic (UDP multicast on 224.0.1.129, IPv6 multicast, or raw IEEE 802.3), and the handler accepts a Delay_Resp from any sender as long as the port is a time receiver using the end-to-end delay mechanism and the message echoes the port identity and a pending sequence id — both of which the victim itself broadcasts in its Delay_Req. Any node on the same link can therefore inject a single crafted Delay_Resp, or simply become the time transmitter and advertise the bogus interval.\n\nOnce the delay timer is armed with a zero timeout, the cooperative PTP thread re-arms and retransmits a Delay_Req on every tick. Each transmission takes a buffer from the fixed CONFIG_PTP_MSG_POLL_SIZE message slab (default 10) and holds it on port->delay_req_list for three seconds, so the slab is emptied within milliseconds and ptp_msg_alloc() then blocks with K_FOREVER inside the only thread that frees those buffers — permanently stalling time synchronization until reboot. Where a transmit-timestamp callback on another thread keeps recycling buffers, the result is instead a sustained multicast Delay_Req flood and continuous CPU consumption. There is no memory corruption and no disclosure of data; the impact is availability of the PTP subsystem and of the local network segment.\n\nThe fix rejects intervals outside a representable range and treats 0x7F as \"not applicable\" as required by IEEE 1588-2019 Table 42. The equivalent unchecked adoption of logMessageInterval from Sync messages in port_sync_msg_process(), a weaker variant of the same issue, is fixed by the companion change 334bf57f416f (#118150), which applies the same range check, ignores the field for unicast Sync messages and treats 0x7F as not applicable."}],"id":"CVE-2026-87042","lastModified":"2026-11-10T22:21:12.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-10T22:21:12.850","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/334bf57f416f2f65745e68db98edf3615ec4e7ab"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/f6b9459f082ac8cc18b7d20a5c4ce1d86b7a55b5"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cx9q-8hq3-7hpr"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/net/lib/ptp/port.c"],"programRoutines":[{"name":"port_delay_resp_msg_process"},{"name":"port_sync_msg_process"},{"name":"port_timer_set_timeout"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.7.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received Delay_Resp message without any validation. port_delay_resp_msg_process() stored the raw wire value (a full-range int8_t) into port_ds.log_min_delay_req_interval, and that value is later used as a shift count by port_timer_set_timeout() when the Delay_Req timer is armed. Values below about -30 truncate the computed timeout to zero, and values with a magnitude of 64 or more perform an undefined shift of a uint64_t; the standards-defined \"not applicable\" encoding 0x7F fell into the latter case as well.\n\nPTP messages are received over unauthenticated link-local traffic (UDP multicast on 224.0.1.129, IPv6 multicast, or raw IEEE 802.3), and the handler accepts a Delay_Resp from any sender as long as the port is a time receiver using the end-to-end delay mechanism and the message echoes the port identity and a pending sequence id — both of which the victim itself broadcasts in its Delay_Req. Any node on the same link can therefore inject a single crafted Delay_Resp, or simply become the time transmitter and advertise the bogus interval.\n\nOnce the delay timer is armed with a zero timeout, the cooperative PTP thread re-arms and retransmits a Delay_Req on every tick. Each transmission takes a buffer from the fixed CONFIG_PTP_MSG_POLL_SIZE message slab (default 10) and holds it on port->delay_req_list for three seconds, so the slab is emptied within milliseconds and ptp_msg_alloc() then blocks with K_FOREVER inside the only thread that frees those buffers — permanently stalling time synchronization until reboot. Where a transmit-timestamp callback on another thread keeps recycling buffers, the result is instead a sustained multicast Delay_Req flood and continuous CPU consumption. There is no memory corruption and no disclosure of data; the impact is availability of the PTP subsystem and of the local network segment.\n\nThe fix rejects intervals outside a representable range and treats 0x7F as \"not applicable\" as required by IEEE 1588-2019 Table 42. The equivalent unchecked adoption of logMessageInterval from Sync messages in port_sync_msg_process(), a weaker variant of the same issue, is fixed by the companion change 334bf57f416f (#118150), which applies the same range check, ignores the field for unicast Sync messages and treats 0x7F as not applicable."}],"id":"CVE-2026-87042","lastModified":"2026-11-13T14:18:01.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-87042","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:39:24.454742Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:12.850","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/334bf57f416f2f65745e68db98edf3615ec4e7ab"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/f6b9459f082ac8cc18b7d20a5c4ce1d86b7a55b5"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cx9q-8hq3-7hpr"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-88833.json b/data/2026/CVE-2026-88833.json
index 9d5f78d210..61fa05ca43 100644
--- a/data/2026/CVE-2026-88833.json
+++ b/data/2026/CVE-2026-88833.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity."}],"id":"CVE-2026-88833","lastModified":"2026-11-09T13:17:09.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88833","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T22:21:57.578888Z","version":"2.0.3"}}]},"published":"2026-10-13T17:17:48.007","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-88833"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531347"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.37.0-9.5.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity."}],"id":"CVE-2026-88833","lastModified":"2026-11-13T14:18:01.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-88833","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T22:21:57.578888Z","version":"2.0.3"}}]},"published":"2026-10-13T17:17:48.007","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99577"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-88833"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531347"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-90832.json b/data/2026/CVE-2026-90832.json
index da1269f5ee..ae917758b1 100644
--- a/data/2026/CVE-2026-90832.json
+++ b/data/2026/CVE-2026-90832.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/bluetooth/host/scan.c"],"programRoutines":[{"name":"bt_hci_le_per_adv_report"},{"name":"bt_hci_le_per_adv_report_common"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.0.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verified that the fixed event header was present and that the controller-declared Data_Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt->length claims. Both reassembly paths — DATA_STATUS_PARTIAL, and DATA_STATUS_COMPLETE while a chain is already in progress — then called net_buf_simple_add_mem(&per_adv_sync->reassembly, buf->data, evt->length), copying up to 255 bytes starting past the end of the event's real payload.\n\nThe Data_Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci_core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends.\n\nExploitation additionally requires CONFIG_BT_PER_ADV_SYNC with CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync.\n\nThe consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt_le_per_adv_sync_cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers."}],"id":"CVE-2026-90832","lastModified":"2026-11-10T22:21:14.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-10T22:21:14.167","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/e9c3252c244b094b9caf6f426ffb77c509e58a9f"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2q4q-gv2c-997j"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/bluetooth/host/scan.c"],"programRoutines":[{"name":"bt_hci_le_per_adv_report"},{"name":"bt_hci_le_per_adv_report_common"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.0.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and _v2) event. It verified that the fixed event header was present and that the controller-declared Data_Length fits the tailroom of the periodic-sync reassembly buffer, but never checked that the event actually carried as many data bytes as evt->length claims. Both reassembly paths — DATA_STATUS_PARTIAL, and DATA_STATUS_COMPLETE while a chain is already in progress — then called net_buf_simple_add_mem(&per_adv_sync->reassembly, buf->data, evt->length), copying up to 255 bytes starting past the end of the event's real payload.\n\nThe Data_Length field originates in the HCI controller, so the flaw is reachable in host-only/split builds where the controller is a separate part reached over H4 UART, SPI, USB or an inter-core IPC transport: a malicious, compromised or buggy controller (or an attacker able to inject on that link) can send a report declaring a length larger than the event payload. The generic event dispatcher in subsys/bluetooth/host/hci_core.c only enforces a per-event minimum length and never cross-checks the subevent's internal length field, so nothing else catches it. Builds using Zephyr's own in-image controller are not affected, because the controller always emits a length matching the bytes it appends.\n\nExploitation additionally requires CONFIG_BT_PER_ADV_SYNC with CONFIG_BT_PER_ADV_SYNC_BUF_SIZE > 0 (the option defaults to 0, which compiles the reassembly block out; LE Audio broadcast-sink and Public Broadcast Profile applications that reassemble fragmented periodic advertising data set it), and an established periodic advertising sync.\n\nThe consequence is an out-of-bounds read of adjacent HCI RX-pool memory — including stale contents of previously received HCI events — which is copied into the reassembly buffer and then delivered to every registered bt_le_per_adv_sync_cb.recv listener as if it were received advertising data, so the disclosed memory becomes application-visible and may be forwarded off-device. The write side remains in bounds because the tailroom check uses the same length value, so there is no memory corruption; impact is limited to information disclosure and undefined behaviour on the over-read. The fix drops any report whose declared length exceeds the remaining event payload, matching the guard already present in the extended and legacy advertising report handlers."}],"id":"CVE-2026-90832","lastModified":"2026-11-13T14:18:01.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:35:14.974838Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:14.167","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/e9c3252c244b094b9caf6f426ffb77c509e58a9f"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-2q4q-gv2c-997j"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-90833.json b/data/2026/CVE-2026-90833.json
index 0c438fc57a..059e8f6863 100644
--- a/data/2026/CVE-2026-90833.json
+++ b/data/2026/CVE-2026-90833.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/eeprom/eeprom_simulator.c"],"programRoutines":[{"name":"eeprom_range_is_valid"},{"name":"eeprom_sim_read"},{"name":"eeprom_sim_write"},{"name":"z_vrfy_eeprom_read"},{"name":"z_vrfy_eeprom_write"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"2.2.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with a single test, (offset + len) <= config->size. Because offset is a signed off_t and len an unsigned size_t of the same rank, the addition is evaluated in unsigned arithmetic: a negative offset combined with a compensating len wraps the sum back into the accepted range. eeprom_sim_read() and eeprom_sim_write() then memcpy() through the EEPROM(addr) macro, which is plain pointer arithmetic on the driver's static mock_eeprom array, so the copy addresses memory located before that array.\n\neeprom_read() and eeprom_write() are __syscall entry points, and their verification handlers in drivers/eeprom/eeprom_handlers.c check only the device object and the caller's own data buffer (K_SYSCALL_MEMORY_READ/K_SYSCALL_MEMORY_WRITE) — the offset argument is passed to the driver unvalidated. With CONFIG_USERSPACE=y, a CONFIG_EEPROM_SIMULATOR device instance, and the device object granted to a user thread (the usage the in-tree tests/drivers/eeprom/api suite exercises from ZTEST_USER threads), an unprivileged thread could supply a negative offset and have the kernel perform the copy on its behalf.\n\nThe result is an out-of-bounds read of kernel .bss returned into the caller's buffer and, via the write path, an out-of-bounds write of caller-supplied bytes over kernel memory preceding mock_eeprom. Both the start address and the length of the affected span are attacker-selected, so the primitive is sufficient to corrupt adjacent kernel state and escape the user-mode sandbox. Exposure is limited to builds that instantiate the simulated EEPROM (status = \"okay\" by default on qemu_x86 and native_sim, otherwise added by a devicetree overlay) together with userspace isolation.\n\nThe fix rejects negative offsets and performs the remaining bound check without overflow."}],"id":"CVE-2026-90833","lastModified":"2026-11-10T22:21:14.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-10T22:21:14.320","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/ce2ec9b3a34d71f52f5d1d7491b91393e334713e"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf6j-hcx8-44vh"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/eeprom/eeprom_simulator.c"],"programRoutines":[{"name":"eeprom_range_is_valid"},{"name":"eeprom_sim_read"},{"name":"eeprom_sim_write"},{"name":"z_vrfy_eeprom_read"},{"name":"z_vrfy_eeprom_write"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"2.2.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with a single test, (offset + len) <= config->size. Because offset is a signed off_t and len an unsigned size_t of the same rank, the addition is evaluated in unsigned arithmetic: a negative offset combined with a compensating len wraps the sum back into the accepted range. eeprom_sim_read() and eeprom_sim_write() then memcpy() through the EEPROM(addr) macro, which is plain pointer arithmetic on the driver's static mock_eeprom array, so the copy addresses memory located before that array.\n\neeprom_read() and eeprom_write() are __syscall entry points, and their verification handlers in drivers/eeprom/eeprom_handlers.c check only the device object and the caller's own data buffer (K_SYSCALL_MEMORY_READ/K_SYSCALL_MEMORY_WRITE) — the offset argument is passed to the driver unvalidated. With CONFIG_USERSPACE=y, a CONFIG_EEPROM_SIMULATOR device instance, and the device object granted to a user thread (the usage the in-tree tests/drivers/eeprom/api suite exercises from ZTEST_USER threads), an unprivileged thread could supply a negative offset and have the kernel perform the copy on its behalf.\n\nThe result is an out-of-bounds read of kernel .bss returned into the caller's buffer and, via the write path, an out-of-bounds write of caller-supplied bytes over kernel memory preceding mock_eeprom. Both the start address and the length of the affected span are attacker-selected, so the primitive is sufficient to corrupt adjacent kernel state and escape the user-mode sandbox. Exposure is limited to builds that instantiate the simulated EEPROM (status = \"okay\" by default on qemu_x86 and native_sim, otherwise added by a devicetree overlay) together with userspace isolation.\n\nThe fix rejects negative offsets and performs the remaining bound check without overflow."}],"id":"CVE-2026-90833","lastModified":"2026-11-13T14:18:01.433","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90833","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:36:31.771160Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:14.320","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/ce2ec9b3a34d71f52f5d1d7491b91393e334713e"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf6j-hcx8-44vh"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-90834.json b/data/2026/CVE-2026-90834.json
index 2d597dcd03..83c0197cec 100644
--- a/data/2026/CVE-2026-90834.json
+++ b/data/2026/CVE-2026-90834.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/serial/uart_handlers.c"],"programRoutines":[{"name":"z_vrfy_uart_poll_out_u16"},{"name":"z_vrfy_uart_rx_enable_u16"},{"name":"z_vrfy_uart_tx_u16"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.0.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The user-mode syscall verifiers for the 16-bit (\"wide data\") UART API in drivers/serial/uart_handlers.c validated the wrong driver operation. z_vrfy_uart_poll_out_u16(), z_vrfy_uart_tx_u16() and z_vrfy_uart_rx_enable_u16() each ran K_SYSCALL_DRIVER_UART() against the 8-bit op (poll_out, tx, rx_enable) rather than the 16-bit op that the corresponding implementation dereferences (poll_out_u16, tx_u16, rx_enable_u16). z_impl_uart_poll_out_u16(), z_impl_uart_tx_u16() and z_impl_uart_rx_enable_u16() in include/zephyr/drivers/uart/uart_internal.h call their op unconditionally, with no NULL guard of their own, because the verifier is supposed to have established that the op exists.\n\nCONFIG_UART_WIDE_DATA is an application-selectable option that no driver selects, and only a handful of the serial drivers in the tree implement any _u16 operation; every other driver leaves those struct uart_driver_api members NULL while still providing the 8-bit ops the old check inspected. In a build with CONFIG_USERSPACE and CONFIG_UART_WIDE_DATA (plus CONFIG_UART_ASYNC_API for the uart_tx_u16() and uart_rx_enable_u16() variants), an unprivileged user-mode thread that legitimately holds access to such a UART device object can invoke the _u16 syscall: the object, permission and op checks all pass, and the kernel-side implementation then performs an indirect call through a NULL function pointer while running at supervisor privilege.\n\nThe result is a CPU exception taken in kernel context instead of the intended K_OOPS or -ENOSYS return. With the default k_sys_fatal_error_handler() this halts the system (or warm-reboots it under CONFIG_RESET_ON_FATAL_ERROR), so a thread confined by the userspace sandbox can deny service to the whole device — a capability the user-mode privilege boundary is specifically meant to withhold. The call target is a fixed NULL, so there is no attacker-controlled code execution and no memory disclosure; the separate K_SYSCALL_MEMORY_ARRAY_READ()/K_SYSCALL_MEMORY_ARRAY_WRITE() bounds checks on the caller's buffer were and remain correct. The fix points each verifier at the matching _u16 op, using a plain K_SYSCALL_OBJ() object check where the op does not exist or where the implementation already tests it for NULL."}],"id":"CVE-2026-90834","lastModified":"2026-11-10T22:21:14.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-10T22:21:14.460","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xvwx-ww79-r346"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["drivers/serial/uart_handlers.c"],"programRoutines":[{"name":"z_vrfy_uart_poll_out_u16"},{"name":"z_vrfy_uart_rx_enable_u16"},{"name":"z_vrfy_uart_tx_u16"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"3.0.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The user-mode syscall verifiers for the 16-bit (\"wide data\") UART API in drivers/serial/uart_handlers.c validated the wrong driver operation. z_vrfy_uart_poll_out_u16(), z_vrfy_uart_tx_u16() and z_vrfy_uart_rx_enable_u16() each ran K_SYSCALL_DRIVER_UART() against the 8-bit op (poll_out, tx, rx_enable) rather than the 16-bit op that the corresponding implementation dereferences (poll_out_u16, tx_u16, rx_enable_u16). z_impl_uart_poll_out_u16(), z_impl_uart_tx_u16() and z_impl_uart_rx_enable_u16() in include/zephyr/drivers/uart/uart_internal.h call their op unconditionally, with no NULL guard of their own, because the verifier is supposed to have established that the op exists.\n\nCONFIG_UART_WIDE_DATA is an application-selectable option that no driver selects, and only a handful of the serial drivers in the tree implement any _u16 operation; every other driver leaves those struct uart_driver_api members NULL while still providing the 8-bit ops the old check inspected. In a build with CONFIG_USERSPACE and CONFIG_UART_WIDE_DATA (plus CONFIG_UART_ASYNC_API for the uart_tx_u16() and uart_rx_enable_u16() variants), an unprivileged user-mode thread that legitimately holds access to such a UART device object can invoke the _u16 syscall: the object, permission and op checks all pass, and the kernel-side implementation then performs an indirect call through a NULL function pointer while running at supervisor privilege.\n\nThe result is a CPU exception taken in kernel context instead of the intended K_OOPS or -ENOSYS return. With the default k_sys_fatal_error_handler() this halts the system (or warm-reboots it under CONFIG_RESET_ON_FATAL_ERROR), so a thread confined by the userspace sandbox can deny service to the whole device — a capability the user-mode privilege boundary is specifically meant to withhold. The call target is a fixed NULL, so there is no attacker-controlled code execution and no memory disclosure; the separate K_SYSCALL_MEMORY_ARRAY_READ()/K_SYSCALL_MEMORY_ARRAY_WRITE() bounds checks on the caller's buffer were and remain correct. The fix points each verifier at the matching _u16 op, using a plain K_SYSCALL_OBJ() object check where the op does not exist or where the implementation already tests it for NULL."}],"id":"CVE-2026-90834","lastModified":"2026-11-13T14:18:01.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:34:36.820599Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:14.460","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/3c13bfd3d3ccdceeb51b884fed5a8d2a49475484"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xvwx-ww79-r346"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-91094.json b/data/2026/CVE-2026-91094.json
new file mode 100644
index 0000000000..3bcdfb6ea4
--- /dev/null
+++ b/data/2026/CVE-2026-91094.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"dpkg","vendor":"Debian","versions":[{"lessThan":"1.23.12","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@debian.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks."}],"id":"CVE-2026-91094","lastModified":"2026-11-13T14:18:01.670","metrics":{},"published":"2026-11-13T14:18:01.670","references":[{"source":"security@debian.org","url":"https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=2a31760bc2a968878700476c1de5b8ea7809e460"},{"source":"security@debian.org","url":"https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=50fb8e7fe20cee0d5b14000c32ca8c31f3bf0574"}],"sourceIdentifier":"security@debian.org","vulnStatus":"Received"}
diff --git a/data/2026/CVE-2026-92241.json b/data/2026/CVE-2026-92241.json
new file mode 100644
index 0000000000..e1308315dd
--- /dev/null
+++ b/data/2026/CVE-2026-92241.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/zephyrproject-rtos/zephyr","defaultStatus":"unaffected","packageName":"zephyr","product":"zephyr","programFiles":["subsys/bluetooth/host/classic/avrcp.c"],"programRoutines":[{"name":"browsing_avrcp_l2cap_alloc_buf"}],"vendor":"zephyrproject","versions":[{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]}],"source":"vulnerabilities@zephyrproject.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in subsys/bluetooth/host/classic/avrcp.c, allocated from the shared avctp_browsing_rx_pool with K_FOREVER. L2CAP invokes that callback from the Bluetooth RX work queue thread (bt_workq, \"BT RX WQ\"), both for the head buffer of a new SDU and — through l2cap_br_alloc_frag() and net_buf_append_bytes() — for every further fragment of a reassembled SDU. That same thread is the only context that ever releases these buffers, after bt_l2cap_br_recv_seg() delivers a completed SDU and calls net_buf_unref(), so a wait taken there can never be satisfied.\n\nThe pool holds CONFIG_BT_MAX_CONN + 1 buffers of CONFIG_BT_AVRCP_BROWSING_L2CAP_MTU bytes (two buffers of 339 bytes in the default configuration). A connected browsing peer can drain it because bt_l2cap_br_recv_seg() in subsys/bluetooth/host/classic/l2cap_br.c accepts the SDU length declared in an SAR_START segment without bounding it by br_chan->rx.mtu: a peer that announces a large SDU and then streams continuation segments forces one pool buffer per segment-worth of data. Once the pool is empty the next allocation blocks forever inside the callback.\n\nTriggering the flaw requires a build with CONFIG_BT_CLASSIC and the experimental CONFIG_BT_AVRCP_BROWSING option, an application that registers AVRCP callbacks, and a BR/EDR peer that has established the AVRCP control channel and then the browsing channel, which requires an encrypted (paired) link. No malformed packet is needed — a few hundred bytes of ordinary segmented L2CAP traffic suffice.\n\nThe consequence is a permanent hang of the whole Bluetooth host, not just of AVRCP: the blocked thread drains bt_dev.rx_queue for all HCI ACL data and low-priority events and also runs the host's internal work items, so all connections stop being serviced and the state is unrecoverable without a reboot. There is no memory-corruption or information-disclosure component. The fix allocates with K_NO_WAIT, so an empty pool now yields a local-busy indication or a channel disconnect that the application can recover from."}],"id":"CVE-2026-92241","lastModified":"2026-11-13T14:18:03.763","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]},"published":"2026-11-13T14:18:01.850","references":[{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/commit/c8c2438f05165397347613b44dd8e9eaa1243139"},{"source":"vulnerabilities@zephyrproject.org","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8vpg-4235-9qjj"}],"sourceIdentifier":"vulnerabilities@zephyrproject.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-833"}],"source":"vulnerabilities@zephyrproject.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92443.json b/data/2026/CVE-2026-92443.json
index 1bad23d051..adb6c17422 100644
--- a/data/2026/CVE-2026-92443.json
+++ b/data/2026/CVE-2026-92443.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers."}],"id":"CVE-2026-92443","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.133","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Proxy-Authorization to different callers."}],"id":"CVE-2026-92443","lastModified":"2026-11-13T14:18:03.973","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:40:03.972145Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:15.133","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92558.json b/data/2026/CVE-2026-92558.json
index 719d988a1c..14de611a4e 100644
--- a/data/2026/CVE-2026-92558.json
+++ b/data/2026/CVE-2026-92558.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route."}],"id":"CVE-2026-92558","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T22:21:15.413","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator characters when building the cache key, allowing a remote attacker to cause a response cached for one request to be served for a different request on the same Route."}],"id":"CVE-2026-92558","lastModified":"2026-11-13T14:18:04.213","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T13:40:40.194258Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:15.413","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92615.json b/data/2026/CVE-2026-92615.json
index c5c8b583c6..0b549ac1fa 100644
--- a/data/2026/CVE-2026-92615.json
+++ b/data/2026/CVE-2026-92615.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1.2::el10","cpe:/a:redhat:edge_manager:1.2::el9"],"defaultStatus":"affected","packageName":"flightctl","product":"RHEM 1.2 for RHEL 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.2-1.el10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1.2::el10","cpe:/a:redhat:edge_manager:1.2::el9"],"defaultStatus":"affected","packageName":"flightctl","product":"RHEM 1.2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.2-1.el9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.2::el10"],"defaultStatus":"affected","packageName":"rhem/flightctl-worker-rhel10","product":"Red Hat Edge Manager 1.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793718463","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.2::el9"],"defaultStatus":"affected","packageName":"rhem/flightctl-worker-rhel9","product":"Red Hat Edge Manager 1.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793718887","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"],"defaultStatus":"affected","packageName":"flightctl","product":"Red Hat Advanced Cluster Management for Kubernetes 2","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol(\"https\", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. \nThis race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations."}],"id":"CVE-2026-92615","lastModified":"2026-11-04T06:17:07.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":4.7,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92615","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-17T15:47:44.857928Z","version":"2.0.3"}}]},"published":"2026-09-16T16:17:23.513","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94608"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94612"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92615"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2518323"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-413"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1.2::el10","cpe:/a:redhat:edge_manager:1.2::el9"],"defaultStatus":"affected","packageName":"flightctl","product":"RHEM 1.2 for RHEL 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.2-1.el10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1.2::el10","cpe:/a:redhat:edge_manager:1.2::el9"],"defaultStatus":"affected","packageName":"flightctl","product":"RHEM 1.2 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.2.2-1.el9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.2::el10"],"defaultStatus":"affected","packageName":"rhem/flightctl-worker-rhel10","product":"Red Hat Edge Manager 1.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793718463","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.2::el9"],"defaultStatus":"affected","packageName":"rhem/flightctl-worker-rhel9","product":"Red Hat Edge Manager 1.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793718887","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.3::el10"],"defaultStatus":"affected","packageName":"rhem/flightctl-periodic-rhel10","product":"Red Hat Edge Manager 1.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793975984","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.3::el10"],"defaultStatus":"affected","packageName":"rhem/flightctl-worker-rhel10","product":"Red Hat Edge Manager 1.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793976378","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.3::el9"],"defaultStatus":"affected","packageName":"rhem/flightctl-periodic-rhel9","product":"Red Hat Edge Manager 1.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793976255","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:edge_manager:1.3::el9"],"defaultStatus":"affected","packageName":"rhem/flightctl-worker-rhel9","product":"Red Hat Edge Manager 1.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793976043","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"],"defaultStatus":"affected","packageName":"flightctl","product":"Red Hat Advanced Cluster Management for Kubernetes 2","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into go-git's process-global client.Protocols map via gitclient.InstallProtocol(\"https\", ...). Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, whichever tenant's repository configuration is written last wins for all in-flight git.Clone calls. \nThis race condition can cause one tenant's TLS settings, including InsecureSkipVerify or mTLS client credentials, to leak into another tenant's git operations."}],"id":"CVE-2026-92615","lastModified":"2026-11-13T13:18:30.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.3,"impactScore":4.7,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92615","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-17T15:47:44.857928Z","version":"2.0.3"}}]},"published":"2026-09-16T16:17:23.513","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94608"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94612"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94632"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96291"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96293"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92615"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2518323"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-413"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92735.json b/data/2026/CVE-2026-92735.json
index 4e191c6e13..01badb6129 100644
--- a/data/2026/CVE-2026-92735.json
+++ b/data/2026/CVE-2026-92735.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"1.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.21.14","status":"unaffected"}],"lessThan":"2.2.2","status":"affected","version":"1.2.0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."}],"id":"CVE-2026-92735","lastModified":"2026-11-13T00:20:18.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security@hashicorp.com","type":"Secondary"}]},"published":"2026-11-13T00:20:18.723","references":[{"source":"security@hashicorp.com","url":"https://discuss.hashicorp.com/t/hcsec-2026-55-vault-integrated-storage-join-may-disclose-server-environment-credentials/78198"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@hashicorp.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"1.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.20.0","status":"affected"},{"at":"1.21.14","status":"unaffected"},{"at":"2.0.0","status":"affected"}],"lessThan":"2.2.2","status":"affected","version":"1.2.0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."}],"id":"CVE-2026-92735","lastModified":"2026-11-13T14:18:05.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security@hashicorp.com","type":"Secondary"}]},"published":"2026-11-13T00:20:18.723","references":[{"source":"security@hashicorp.com","url":"https://discuss.hashicorp.com/t/hcsec-2026-55-vault-integrated-storage-join-may-disclose-server-environment-credentials/78198"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@hashicorp.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92822.json b/data/2026/CVE-2026-92822.json
index 78ae4ad43e..bb5540b5f1 100644
--- a/data/2026/CVE-2026-92822.json
+++ b/data/2026/CVE-2026-92822.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service."}],"id":"CVE-2026-92822","lastModified":"2026-11-06T08:17:38.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92822","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-21T20:42:42.905112Z","version":"2.0.3"}}]},"published":"2026-10-21T04:18:11.980","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92822"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479002"},{"source":"secalert@redhat.com","url":"https://github.com/advisories/GHSA-85r9-7wj5-x6x5"},{"source":"secalert@redhat.com","url":"https://github.com/fedora-modularity/libmodulemd/pull/645"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479002"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"libmodulemd-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.15.4-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service."}],"id":"CVE-2026-92822","lastModified":"2026-11-13T14:18:07.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92822","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-21T20:42:42.905112Z","version":"2.0.3"}}]},"published":"2026-10-21T04:18:11.980","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95982"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92822"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479002"},{"source":"secalert@redhat.com","url":"https://github.com/advisories/GHSA-85r9-7wj5-x6x5"},{"source":"secalert@redhat.com","url":"https://github.com/fedora-modularity/libmodulemd/pull/645"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479002"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92823.json b/data/2026/CVE-2026-92823.json
index 916b9ff9ce..5b4553a31b 100644
--- a/data/2026/CVE-2026-92823.json
+++ b/data/2026/CVE-2026-92823.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service."}],"id":"CVE-2026-92823","lastModified":"2026-11-06T08:17:38.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92823","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-21T15:00:02.575963Z","version":"2.0.3"}}]},"published":"2026-10-21T04:18:12.127","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92823"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478703"},{"source":"secalert@redhat.com","url":"https://github.com/advisories/GHSA-x9m8-9g38-v659"},{"source":"secalert@redhat.com","url":"https://github.com/fedora-modularity/libmodulemd/pull/644"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"libmodulemd-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.15.4-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service."}],"id":"CVE-2026-92823","lastModified":"2026-11-13T14:18:20.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92823","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-21T15:00:02.575963Z","version":"2.0.3"}}]},"published":"2026-10-21T04:18:12.127","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95982"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92823"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478703"},{"source":"secalert@redhat.com","url":"https://github.com/advisories/GHSA-x9m8-9g38-v659"},{"source":"secalert@redhat.com","url":"https://github.com/fedora-modularity/libmodulemd/pull/644"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92824.json b/data/2026/CVE-2026-92824.json
index a0837eb1c8..36fc959724 100644
--- a/data/2026/CVE-2026-92824.json
+++ b/data/2026/CVE-2026-92824.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service."}],"id":"CVE-2026-92824","lastModified":"2026-11-06T08:17:39.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92824","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-26T17:35:01.486314Z","version":"2.0.3"}}]},"published":"2026-10-21T04:18:12.263","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92824"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478495"},{"source":"secalert@redhat.com","url":"https://github.com/advisories/GHSA-j65x-29mg-x4cj"},{"source":"secalert@redhat.com","url":"https://github.com/fedora-modularity/libmodulemd/pull/643"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"libmodulemd-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2.15.4-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"libmodulemd","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift/ose-rhel-coreos-9","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service."}],"id":"CVE-2026-92824","lastModified":"2026-11-13T14:18:22.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92824","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-26T17:35:01.486314Z","version":"2.0.3"}}]},"published":"2026-10-21T04:18:12.263","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95982"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92824"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478495"},{"source":"secalert@redhat.com","url":"https://github.com/advisories/GHSA-j65x-29mg-x4cj"},{"source":"secalert@redhat.com","url":"https://github.com/fedora-modularity/libmodulemd/pull/643"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-93017.json b/data/2026/CVE-2026-93017.json
index 84e0c28930..b71527e700 100644
--- a/data/2026/CVE-2026-93017.json
+++ b/data/2026/CVE-2026-93017.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel8-operator","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792974936","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel8-operator","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791842870","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791632611","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792879727","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792874579","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791626249","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791625576","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791980436","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792771251","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n  - \"\"\n  resources:\n  - secrets\n  verbs:\n  - get\n  - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```"}],"id":"CVE-2026-93017","lastModified":"2026-10-30T05:17:00.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-93017","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-10T03:09:17.420970Z","version":"2.0.3"}}]},"published":"2026-10-08T15:17:56.950","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82785"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82813"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83480"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83502"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83702"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89198"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89726"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90274"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-93017"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515741"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel8-operator","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792974936","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel8-operator","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793825599","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel8-operator","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791842870","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791632611","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792879727","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1793904247","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792874579","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791626249","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791625576","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791980436","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 4.22","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792771251","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:5"],"defaultStatus":"affected","packageName":"openshift5/ose-insights-rhel9-operator","product":"Red Hat OpenShift Container Platform 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n  - \"\"\n  resources:\n  - secrets\n  verbs:\n  - get\n  - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```"}],"id":"CVE-2026-93017","lastModified":"2026-11-13T14:18:23.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-93017","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-10T03:09:17.420970Z","version":"2.0.3"}}]},"published":"2026-10-08T15:17:56.950","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82785"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:82813"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83480"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83502"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:83702"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89198"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89715"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89726"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90274"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:95746"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:96283"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-93017"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515741"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-93333.json b/data/2026/CVE-2026-93333.json
index e6ebc05873..ec9742d33d 100644
--- a/data/2026/CVE-2026-93333.json
+++ b/data/2026/CVE-2026-93333.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"0.7.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.21.14","status":"unaffected"}],"lessThan":"2.2.2","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."}],"id":"CVE-2026-93333","lastModified":"2026-11-13T00:20:18.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"security@hashicorp.com","type":"Secondary"}]},"published":"2026-11-13T00:20:18.883","references":[{"source":"security@hashicorp.com","url":"https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"}],"source":"security@hashicorp.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"0.7.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.20.0","status":"affected"},{"at":"1.21.14","status":"unaffected"},{"at":"2.0.0","status":"affected"}],"lessThan":"2.2.2","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."}],"id":"CVE-2026-93333","lastModified":"2026-11-13T14:18:24.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"security@hashicorp.com","type":"Secondary"}]},"published":"2026-11-13T00:20:18.883","references":[{"source":"security@hashicorp.com","url":"https://discuss.hashicorp.com/t/hcsec-2026-57-vault-audit-device-prefix-vulnerable-to-log-injection/78200"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-117"}],"source":"security@hashicorp.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-93335.json b/data/2026/CVE-2026-93335.json
index 24488f597f..23b25a277f 100644
--- a/data/2026/CVE-2026-93335.json
+++ b/data/2026/CVE-2026-93335.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"0.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.21.14","status":"unaffected"}],"lessThan":"2.2.2","status":"affected","version":"0.2.0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."}],"id":"CVE-2026-93335","lastModified":"2026-11-13T00:20:19.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"security@hashicorp.com","type":"Secondary"}]},"published":"2026-11-13T00:20:19.023","references":[{"source":"security@hashicorp.com","url":"https://discuss.hashicorp.com/t/hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash/78199"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-647"}],"source":"security@hashicorp.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"0.2.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","repo":"https://github.com/hashicorp/vault","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.25","status":"unaffected"},{"at":"1.20.0","status":"affected"},{"at":"1.21.14","status":"unaffected"},{"at":"2.0.0","status":"affected"}],"lessThan":"2.2.2","status":"affected","version":"0.2.0","versionType":"semver"}]}],"source":"security@hashicorp.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25."}],"id":"CVE-2026-93335","lastModified":"2026-11-13T14:18:24.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"security@hashicorp.com","type":"Secondary"}]},"published":"2026-11-13T00:20:19.023","references":[{"source":"security@hashicorp.com","url":"https://discuss.hashicorp.com/t/hcsec-2026-56-vault-vulnerable-to-acl-deny-bypass-via-trailing-slash/78199"}],"sourceIdentifier":"security@hashicorp.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-647"}],"source":"security@hashicorp.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-95518.json b/data/2026/CVE-2026-95518.json
new file mode 100644
index 0000000000..d0fa8f7df1
--- /dev/null
+++ b/data/2026/CVE-2026-95518.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pardus Package Installer","vendor":"TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü","versions":[{"lessThan":"0.7.1","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü Pardus Package Installer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.\n\nThis issue affects Pardus Package Installer: from 0.7.0 before 0.7.1."}],"id":"CVE-2026-95518","lastModified":"2026-11-13T13:18:31.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-13T13:18:31.217","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1539"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-95520.json b/data/2026/CVE-2026-95520.json
index 53c00cc8b0..d88e118f49 100644
--- a/data/2026/CVE-2026-95520.json
+++ b/data/2026/CVE-2026-95520.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"rpm","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"rpm","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}],"id":"CVE-2026-95520","lastModified":"2026-11-06T08:17:39.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-29T13:17:45.627559Z","version":"2.0.3"}}]},"published":"2026-09-29T12:17:12.650","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-95520"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537809"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"rpm-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"6.1.0-1.4.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"rpm","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"rpm","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"rpm","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ai-gateway-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-core-bff-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-dashboard-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-dashboard-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-data-science-pipelines-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-kf-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-llmisvc-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kserve-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kuberay-operator-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-kube-rbac-proxy-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-llama-stack-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-maas-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-agent-ops-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-automl-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-autorag-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-eval-hub-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-gen-ai-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-maas-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-mlflow-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-mod-arch-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-serving-api-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unknown","packageName":"rhoai/odh-notebook-controller-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-k8s-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-ogx-module-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-training-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-trustyai-service-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbenches-operator-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an  untrusted package."}],"id":"CVE-2026-95520","lastModified":"2026-11-13T14:18:24.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-95520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-29T13:17:45.627559Z","version":"2.0.3"}}]},"published":"2026-09-29T12:17:12.650","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98095"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-95520"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537809"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/state/sync.json b/state/sync.json
index 881c9ad71b..e0471a02a4 100644
--- a/state/sync.json
+++ b/state/sync.json
@@ -1 +1 @@
-{"initial_complete":true,"last_run_counts":{"seen":5156,"skipped":39,"unchanged":5110,"written":7},"last_run_mode":"incremental","last_successful_end":"2026-11-13T12:42:51+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-13T12:48:44.453907+00:00"}
+{"initial_complete":true,"last_run_counts":{"seen":5161,"skipped":39,"unchanged":4949,"written":173},"last_run_mode":"incremental","last_successful_end":"2026-11-13T14:42:51+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-13T14:50:25.514067+00:00"}